LINE for iOS CVE-2025-14021

Exploitation requires the victim to open an attacker-supplied URL specifically within the LINE client's in-app browser (not Safari or an external browser), and the malicious page must use iframe-based content rendering to exploit the address-bar spoofing behavior. Exploitation is limited by mandatory user interaction (UI:R): the attacker must socially engineer the target into clicking the link and then into trusting the spoofed trusted URL and entering data. It affects only LINE for iOS versions prior to 14.14; devices updated to 14.14 or later are not affected. No elevated privileges or prior authentication to the target app are required of the attacker.

This is a genuinely low-to-moderate priority issue, and the available signals are largely consistent on that point. The vendor-supplied CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N) yields 4.3 (Medium): network-reachable and low-complexity, but requiring user interaction (UI:R) and delivering only a limited integrity impact (I:L) with no confidentiality or availability loss - appropriate for an address-bar-spoofing/UI-redressing flaw (CWE-451). EPSS reinforces low urgency at 0.21% (11th percentile), and the CVE is NOT in CISA KEV, so there is no evidence of active exploitation. No SSVC decision data was provided in the input. The one reference is a HackerOne report (#2548498), which indicates the bug was researched and disclosed through a bounty program, but the input does not flag POC=YES, so public weaponized exploit code cannot be confirmed from the data provided. The signals do not conflict: a spoofing bug that enables phishing is realistically a targeted social-engineering aid rather than a mass-exploited RCE, matching the low EPSS and absence from KEV. The main caveat is that the real-world impact of phishing can exceed the mechanical I:L rating because successful credential/data theft depends on the victim, not the CVSS math.

An attacker lures a LINE for iOS user into opening a malicious link inside the app's in-app browser; the page renders attacker-controlled JavaScript within an iframe while the browser's address bar continues to display a trusted URL. Believing they are on a legitimate site, the victim enters credentials or other sensitive data into the overlaid phishing content. A HackerOne report exists for this issue, but public exploit code is not confirmed from the provided data.