CVE-2025-14019 - Vulnerability Details - OpenCVE

LINE client for Android versions from 13.8 to 15.5 is vulnerable to UI spoofing in the in-app browser where a specific layout could obscure the full-screen warning prompt, potentially allowing attackers to conduct phishing attacks.

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Changed

Confidentiality Impact None

Integrity Impact Low

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Google	Android
Linecorp	Line

No data.

No data.

References

Link	Providers
https://hackerone.com/reports/3062270

History

Mon, 15 Dec 2025 16:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-451
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Mon, 15 Dec 2025 14:15:00 +0000

Type	Values Removed	Values Added
First Time appeared		Google Google android Linecorp Linecorp line
Vendors & Products		Google Google android Linecorp Linecorp line

Mon, 15 Dec 2025 07:00:00 +0000

Type	Values Removed	Values Added
Description		LINE client for Android versions from 13.8 to 15.5 is vulnerable to UI spoofing in the in-app browser where a specific layout could obscure the full-screen warning prompt, potentially allowing attackers to conduct phishing attacks.
References		https://hackerone.com/reports/3062270
Metrics		cvssV3_1 `{'score': 3.4, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:L/A:N'}`

MITRE

Status: PUBLISHED

Assigner: LY-Corporation

Published: 2025-12-15T06:38:05.914Z

Updated: 2025-12-15T15:53:29.670Z

Reserved: 2025-12-04T11:44:41.504Z

Link: CVE-2025-14019

Vulnrichment

Updated: 2025-12-15T15:53:20.717Z

NVD

Status : Awaiting Analysis

Published: 2025-12-15T07:15:49.437

Modified: 2025-12-15T18:22:13.783

Link: CVE-2025-14019

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-14019", "assignerOrgId": "657f3255-0560-4aed-82e4-7f579ec6acfb", "state": "PUBLISHED", "assignerShortName": "LY-Corporation", "dateReserved": "2025-12-04T11:44:41.504Z", "datePublished": "2025-12-15T06:38:05.914Z", "dateUpdated": "2025-12-15T15:53:29.670Z"}, "containers": {"cna": {"affected": [{"vendor": "LINE Corporation", "product": "LINE client for Android", "versions": [{"version": "13.8", "status": "affected", "versionType": "custom", "lessThan": "15.6"}]}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "na"}]}], "descriptions": [{"lang": "en", "value": "LINE client for Android versions from 13.8 to 15.5 is vulnerable to UI spoofing in the in-app browser where a specific layout could obscure the full-screen warning prompt, potentially allowing attackers to conduct phishing attacks."}], "references": [{"url": "https://hackerone.com/reports/3062270"}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:L/A:N", "attackVector": "NETWORK", "attackComplexity": "HIGH", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "CHANGED", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "availabilityImpact": "NONE", "baseScore": 3.4, "baseSeverity": "LOW", "exploitCodeMaturity": "NOT_DEFINED", "remediationLevel": "NOT_DEFINED", "reportConfidence": "NOT_DEFINED", "temporalScore": 3.4, "temporalSeverity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "availabilityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NETWORK", "modifiedAttackComplexity": "HIGH", "modifiedPrivilegesRequired": "NONE", "modifiedUserInteraction": "REQUIRED", "modifiedScope": "CHANGED", "modifiedConfidentialityImpact": "NONE", "modifiedIntegrityImpact": "LOW", "modifiedAvailabilityImpact": "NONE", "environmentalScore": 3.4, "environmentalSeverity": "LOW"}}], "providerMetadata": {"orgId": "657f3255-0560-4aed-82e4-7f579ec6acfb", "shortName": "LY-Corporation", "dateUpdated": "2025-12-15T06:38:05.914Z"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-451", "lang": "en", "description": "CWE-451 User Interface (UI) Misrepresentation of Critical Information"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-12-15T15:53:26.382497Z", "id": "CVE-2025-14019", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-15T15:53:29.670Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-14019", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-15T15:53:26.382497Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-451", "description": "CWE-451 User Interface (UI) Misrepresentation of Critical Information"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-15T15:53:20.717Z"}}], "cna": {"metrics": [{"cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 3.4, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:N/I:L/A:N", "modifiedScope": "CHANGED", "temporalScore": 3.4, "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "remediationLevel": "NOT_DEFINED", "reportConfidence": "NOT_DEFINED", "temporalSeverity": "LOW", "availabilityImpact": "NONE", "environmentalScore": 3.4, "privilegesRequired": "NONE", "exploitCodeMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NETWORK", "confidentialityImpact": "NONE", "environmentalSeverity": "LOW", "availabilityRequirement": "NOT_DEFINED", "modifiedIntegrityImpact": "LOW", "modifiedUserInteraction": "REQUIRED", "modifiedAttackComplexity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAvailabilityImpact": "NONE", "modifiedPrivilegesRequired": "NONE", "modifiedConfidentialityImpact": "NONE"}}], "affected": [{"vendor": "LINE Corporation", "product": "LINE client for Android", "versions": [{"status": "affected", "version": "13.8", "lessThan": "15.6", "versionType": "custom"}]}], "references": [{"url": "https://hackerone.com/reports/3062270"}], "descriptions": [{"lang": "en", "value": "LINE client for Android versions from 13.8 to 15.5 is vulnerable to UI spoofing in the in-app browser where a specific layout could obscure the full-screen warning prompt, potentially allowing attackers to conduct phishing attacks."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "na"}]}], "providerMetadata": {"orgId": "657f3255-0560-4aed-82e4-7f579ec6acfb", "shortName": "LY-Corporation", "dateUpdated": "2025-12-15T06:38:05.914Z"}}}, "cveMetadata": {"cveId": "CVE-2025-14019", "state": "PUBLISHED", "dateUpdated": "2025-12-15T15:53:29.670Z", "dateReserved": "2025-12-04T11:44:41.504Z", "assignerOrgId": "657f3255-0560-4aed-82e4-7f579ec6acfb", "datePublished": "2025-12-15T06:38:05.914Z", "assignerShortName": "LY-Corporation"}, "dataVersion": "5.2"}