CVE-2025-14020: 
NixOS vulnerability analysis and mitigation

CVE-2025-14020 is a UI spoofing vulnerability in the LINE client for Android affecting all versions prior to 14.20. The flaw exists in the app's in-app browser, where a full-screen security Toast notification fails to re-display when a user returns from another application, enabling attackers to conduct phishing attacks by impersonating legitimate interfaces. It was published on December 15, 2025, and assigned by LY Corporation. The CVSS v3.1 base score is 4.3 (Medium) per NVD, with an alternative score of 5.4 (Medium) noted by ENISA (Red Hat CVE, ENISA EUVD).

The root cause is classified as CWE-451 (User Interface Misrepresentation of Critical Information). When a user opens a URL in LINE's in-app browser and then switches to another application before returning, the security Toast notification — which warns users they are viewing external web content — is not re-rendered upon return. This creates a window where a malicious web page can visually impersonate a trusted interface without the expected security indicator being visible. The vulnerability is network-accessible and requires user interaction (e.g., clicking a malicious link shared via LINE) but requires no privileges or authentication (Red Hat CVE, ENISA EUVD). A HackerOne report (report #2547989) is referenced as the original disclosure source (ENISA EUVD).

Successful exploitation allows an attacker to present a spoofed interface to the victim without the security Toast notification, facilitating phishing attacks that can deceive users into submitting credentials or sensitive personal data. The integrity impact is low (UI deception rather than direct data modification), and there is no direct confidentiality or availability impact at the system level. However, the practical risk to end users is credential theft and account compromise through social engineering (Red Hat CVE, ENISA EUVD).

No public exploit code or active in-the-wild exploitation has been reported for CVE-2025-14020. The EPSS score is approximately 0.028%, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires user interaction — specifically, a victim must click a malicious link within LINE and then switch away from and return to the app (Red Hat CVE).

1. Craft a phishing page: Attacker creates a convincing fake login page (e.g., mimicking LINE, a bank, or another trusted service) hosted on an attacker-controlled domain.
2. Distribute the link via LINE: Attacker sends the malicious URL to a target user through LINE messaging, exploiting the trust users place in links shared within the app.
3. Victim opens the link: The victim taps the link, which opens in LINE's in-app browser. The security Toast notification is displayed briefly, warning the user they are viewing external content.
4. Trigger the vulnerability: The attacker's page (or a social engineering prompt) causes the victim to briefly switch to another app (e.g., via a notification or prompt) and then return to LINE.
5. Security notification absent: Upon returning, the security Toast notification is not re-displayed, leaving the malicious page appearing as if it were a trusted in-app interface.
6. Credential harvesting: The victim, unaware they are on an external phishing page, enters credentials or sensitive information which is captured by the attacker (ENISA EUVD, Infinit Sec).

LY Corporation has addressed this vulnerability in LINE for Android version 14.20 and later. Users should update the LINE app to version 14.20 or above via the Google Play Store. No configuration-based workaround is available; updating to the patched version is the only recommended remediation. Organizations managing Android devices should enforce app version policies to ensure LINE is updated promptly (Red Hat CVE, ENISA EUVD).

The vulnerability was originally disclosed through HackerOne (report #2547989) and subsequently tracked by ENISA's European Vulnerability Database and Red Hat's CVE advisory system. Coverage has been limited to automated vulnerability tracking platforms and security news aggregators, with no notable researcher commentary or significant social media discussion identified (ENISA EUVD, Infinit Sec).