LINE for iOS CVE-2025-14023

Exploitation requires a victim to open an attacker-supplied link inside the LINE for iOS in-app browser and to interact with the resulting page (UI:R); the flaw manifests only 'under specific conditions' where the in-app browser's navigation state and its displayed UI (address/trust indicators) fall out of sync. Limiting factors: it affects only the embedded in-app browser (not the OS/default browser), requires user interaction and social engineering to deliver and open the link, is unauthenticated but non-automatable, and yields only a spoofed trust context (I:L) - no direct code execution, credential capture, or data access occurs without the victim then acting on the deception. Only LINE for iOS prior to 15.19 is affected.

This is a genuinely LOW-priority issue despite affecting a very popular product. All signals agree: the CVSS 3.1 base score is only 4.3 (Medium), driven by AV:N/AC:L/PR:N but tempered by UI:R (victim interaction required), S:U, and an impact profile of C:N/I:L/A:N - the only impact is a low-integrity UI misrepresentation (CWE-451 spoofing), with no confidentiality or availability loss and no code execution. EPSS reinforces this at 0.18% (7th percentile), indicating very low predicted exploitation likelihood. There is no CISA KEV listing (not actively exploited) and no confirmed public exploit code - the sole reference is a HackerOne report, which documents the finding but does not by itself establish published weaponized exploit code. No signals conflict: a low CVSS, low EPSS, no KEV, and a spoofing-only impact all point the same direction. The note worth flagging is tag-level: the input Tag 'Information Disclosure' is inconsistent with the CVSS vector's C:N (no confidentiality impact) and with CWE-451 (UI spoofing), so this should be understood as a spoofing/phishing-enabler, not a data-leak bug.

An attacker sends a crafted link to a victim via LINE chat; when the victim opens it in LINE's in-app browser, a mismatch between the actual navigation state and the rendered browser UI misrepresents the page's trust context (e.g. address or security indicators), making a malicious page appear legitimate to support a phishing or spoofing attack. Exploitation requires the victim to open the link and interact (UI:R), so it is opportunistic rather than automated. A HackerOne report exists, but no confirmed public exploit code was identified.