CVE-2025-14021: 
NixOS vulnerability analysis and mitigation

CVE-2025-14021 is an address bar spoofing vulnerability in the in-app browser of the LINE client for iOS. It affects LINE for iOS versions prior to 14.14 and allows attackers to display trusted URLs in the address bar while executing malicious JavaScript within iframes, enabling phishing attacks through overlaid malicious content. The vulnerability was published on December 15, 2025, and was assigned by LY Corporation. It carries a CVSS v3.1 base score of 4.3 (Medium) (Feedly, ENISA EUVD).

The root cause is classified as CWE-451 (User Interface Misrepresentation of Critical Information), where the LINE iOS in-app browser fails to accurately reflect the actual page origin in the address bar during iframe navigation or JavaScript execution. An attacker can craft a malicious web page that, when opened via the LINE in-app browser, loads a trusted URL visually in the address bar while simultaneously executing attacker-controlled JavaScript within an iframe — effectively overlaying phishing content on top of the spoofed trusted URL. Exploitation requires user interaction, specifically a victim clicking a malicious link shared within LINE. A HackerOne report (report #2548498) is referenced as the disclosure source (ENISA EUVD, HackerOne).

Successful exploitation allows an attacker to conduct convincing phishing attacks against LINE iOS users by displaying a legitimate-looking URL while presenting malicious content. The primary impact is on integrity (low), as the attacker can deceive users into submitting credentials or sensitive information to attacker-controlled infrastructure. Confidentiality and availability are not directly impacted by this vulnerability, but credential theft resulting from phishing could lead to account compromise and downstream data exposure (Feedly, ENISA EUVD).

No public exploit code or active in-the-wild exploitation has been reported for CVE-2025-14021. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.029% (0.000290), indicating a very low probability of exploitation in the near term. Exploitation requires user interaction — a victim must click a malicious link within the LINE app — which further limits the attack surface (Feedly).

1. Craft malicious page: The attacker creates a web page that loads a trusted URL (e.g., a legitimate banking or social media site) in an iframe while overlaying attacker-controlled HTML/JavaScript content on top.
2. Distribute via LINE: The attacker shares the malicious link through LINE messages, group chats, or LINE Open Chat, targeting iOS users running LINE versions prior to 14.14.
3. Victim opens link: The victim taps the link, which opens in LINE's in-app browser. The address bar displays the trusted URL, while the iframe renders the attacker's phishing content.
4. Execute malicious JavaScript: The attacker's JavaScript runs within the iframe context, potentially presenting fake login forms, credential harvesting overlays, or other deceptive UI elements.
5. Harvest credentials: The victim, believing they are on a trusted site, submits credentials or sensitive information that is captured by the attacker's server (HackerOne, ENISA EUVD).

• Network: Outbound connections from LINE app to unexpected or newly registered domains after a user taps a link; HTTP requests to domains hosting iframe-based phishing pages.
• Logs: LINE app network traffic logs showing navigation to a trusted domain followed by iframe loads from a different, unrelated domain.
• User Reports: Users reporting unexpected login prompts or credential requests appearing within the LINE in-app browser when opening shared links.

LY Corporation has addressed this vulnerability in LINE for iOS version 14.14 and later. Users should update the LINE app to version 14.14 or above via the Apple App Store immediately. No configuration-based workaround is available; upgrading is the only remediation. Organizations should advise users to be cautious of links shared via LINE and to verify URLs in an external browser when in doubt (Feedly, ENISA EUVD).

Coverage of CVE-2025-14021 has been limited to vulnerability tracking platforms and security databases, with no notable vendor statements beyond the patch release or significant researcher commentary identified. The vulnerability was disclosed via HackerOne's coordinated disclosure program, suggesting responsible disclosure practices were followed (HackerOne).