CVE-2025-14020 - Vulnerability Details - OpenCVE

LINE client for Android versions prior to 14.20 contains a UI spoofing vulnerability in the in-app browser where the full-screen security Toast notification is not properly re-displayed when users return from another application, potentially allowing attackers to conduct phishing attacks by impersonating legitimate interfaces.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Google	Android
Linecorp	Line

No data.

No data.

References

Link	Providers
https://hackerone.com/reports/2547989

History

Mon, 15 Dec 2025 16:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-451
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Mon, 15 Dec 2025 14:15:00 +0000

Type	Values Removed	Values Added
First Time appeared		Google Google android Linecorp Linecorp line
Vendors & Products		Google Google android Linecorp Linecorp line

Mon, 15 Dec 2025 07:00:00 +0000

Type	Values Removed	Values Added
Description		LINE client for Android versions prior to 14.20 contains a UI spoofing vulnerability in the in-app browser where the full-screen security Toast notification is not properly re-displayed when users return from another application, potentially allowing attackers to conduct phishing attacks by impersonating legitimate interfaces.
References		https://hackerone.com/reports/2547989
Metrics		cvssV3_1 `{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N'}`

MITRE

Status: PUBLISHED

Assigner: LY-Corporation

Published: 2025-12-15T06:39:51.980Z

Updated: 2025-12-15T15:52:04.173Z

Reserved: 2025-12-04T11:44:51.875Z

Link: CVE-2025-14020

Vulnrichment

Updated: 2025-12-15T15:51:56.061Z

NVD

Status : Awaiting Analysis

Published: 2025-12-15T07:15:50.720

Modified: 2025-12-15T18:22:13.783

Link: CVE-2025-14020

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-14020", "assignerOrgId": "657f3255-0560-4aed-82e4-7f579ec6acfb", "state": "PUBLISHED", "assignerShortName": "LY-Corporation", "dateReserved": "2025-12-04T11:44:51.875Z", "datePublished": "2025-12-15T06:39:51.980Z", "dateUpdated": "2025-12-15T15:52:04.173Z"}, "containers": {"cna": {"affected": [{"vendor": "LINE Corporation", "product": "LINE client for Android", "versions": [{"version": "10.0", "status": "affected", "versionType": "custom", "lessThan": "14.20"}]}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "na"}]}], "descriptions": [{"lang": "en", "value": "LINE client for Android versions prior to 14.20 contains a UI spoofing vulnerability in the in-app browser where the full-screen security Toast notification is not properly re-displayed when users return from another application, potentially allowing attackers to conduct phishing attacks by impersonating legitimate interfaces."}], "references": [{"url": "https://hackerone.com/reports/2547989"}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "availabilityImpact": "NONE", "baseScore": 5.4, "baseSeverity": "MEDIUM", "exploitCodeMaturity": "NOT_DEFINED", "remediationLevel": "NOT_DEFINED", "reportConfidence": "NOT_DEFINED", "temporalScore": 5.4, "temporalSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "availabilityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NETWORK", "modifiedAttackComplexity": "LOW", "modifiedPrivilegesRequired": "NONE", "modifiedUserInteraction": "REQUIRED", "modifiedScope": "UNCHANGED", "modifiedConfidentialityImpact": "LOW", "modifiedIntegrityImpact": "LOW", "modifiedAvailabilityImpact": "NONE", "environmentalScore": 5.4, "environmentalSeverity": "MEDIUM"}}], "providerMetadata": {"orgId": "657f3255-0560-4aed-82e4-7f579ec6acfb", "shortName": "LY-Corporation", "dateUpdated": "2025-12-15T06:39:51.980Z"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-451", "lang": "en", "description": "CWE-451 User Interface (UI) Misrepresentation of Critical Information"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-12-15T15:52:00.170038Z", "id": "CVE-2025-14020", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-15T15:52:04.173Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-14020", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-15T15:52:00.170038Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-451", "description": "CWE-451 User Interface (UI) Misrepresentation of Critical Information"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-15T15:51:56.061Z"}}], "cna": {"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N", "modifiedScope": "UNCHANGED", "temporalScore": 5.4, "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "remediationLevel": "NOT_DEFINED", "reportConfidence": "NOT_DEFINED", "temporalSeverity": "MEDIUM", "availabilityImpact": "NONE", "environmentalScore": 5.4, "privilegesRequired": "NONE", "exploitCodeMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NETWORK", "confidentialityImpact": "LOW", "environmentalSeverity": "MEDIUM", "availabilityRequirement": "NOT_DEFINED", "modifiedIntegrityImpact": "LOW", "modifiedUserInteraction": "REQUIRED", "modifiedAttackComplexity": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAvailabilityImpact": "NONE", "modifiedPrivilegesRequired": "NONE", "modifiedConfidentialityImpact": "LOW"}}], "affected": [{"vendor": "LINE Corporation", "product": "LINE client for Android", "versions": [{"status": "affected", "version": "10.0", "lessThan": "14.20", "versionType": "custom"}]}], "references": [{"url": "https://hackerone.com/reports/2547989"}], "descriptions": [{"lang": "en", "value": "LINE client for Android versions prior to 14.20 contains a UI spoofing vulnerability in the in-app browser where the full-screen security Toast notification is not properly re-displayed when users return from another application, potentially allowing attackers to conduct phishing attacks by impersonating legitimate interfaces."}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "na"}]}], "providerMetadata": {"orgId": "657f3255-0560-4aed-82e4-7f579ec6acfb", "shortName": "LY-Corporation", "dateUpdated": "2025-12-15T06:39:51.980Z"}}}, "cveMetadata": {"cveId": "CVE-2025-14020", "state": "PUBLISHED", "dateUpdated": "2025-12-15T15:52:04.173Z", "dateReserved": "2025-12-04T11:44:51.875Z", "assignerOrgId": "657f3255-0560-4aed-82e4-7f579ec6acfb", "datePublished": "2025-12-15T06:39:51.980Z", "assignerShortName": "LY-Corporation"}, "dataVersion": "5.2"}