CVE-2025-14019
📋 TL;DR
LINE for Android versions 13.8 through 15.5 contains a UI spoofing vulnerability in its in-app browser. Attackers can obscure full-screen warning prompts with malicious layouts, potentially tricking users into interacting with phishing content. This affects all Android users running vulnerable LINE versions.
💻 Affected Systems
- LINE for Android
📦 What is this software?
Line by Linecorp
⚠️ Risk & Real-World Impact
Worst Case
Users could be tricked into entering credentials, payment information, or other sensitive data into phishing pages that appear legitimate within the LINE app.
Likely Case
Attackers create convincing phishing pages that bypass LINE's security warnings, leading to credential harvesting or financial fraud.
If Mitigated
With user awareness training and updated versions, the risk is limited to users who ignore remaining visual cues or interact with suspicious content.
🎯 Exploit Status
Exploitation requires user interaction (clicking a malicious link) but no authentication. The technique involves crafting HTML/CSS to overlay warning prompts.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 15.6 or later
Vendor Advisory: https://hackerone.com/reports/3062270
Restart Required: No
Instructions:
1. Open Google Play Store. 2. Search for LINE. 3. Tap Update if version is below 15.6. 4. Alternatively, enable auto-update for LINE in Play Store settings.
🔧 Temporary Workarounds
Use External Browser
androidConfigure LINE to open links in an external browser instead of the in-app browser.
Open LINE > Settings > Privacy > Turn OFF 'Open links in app'
🧯 If You Can't Patch
- Educate users to never enter credentials or sensitive information when prompted within LINE's in-app browser.
- Implement network filtering to block known phishing domains at the firewall/proxy level.
🔍 How to Verify
Check if Vulnerable:
Check LINE version in app: Open LINE > Settings > About LINE > Version. If between 13.8 and 15.5 inclusive, vulnerable.Check Version:
Not applicable for mobile apps; use in-app version check.Verify Fix Applied:
Verify LINE version is 15.6 or higher using same method as above.📡 Detection & Monitoring
Log Indicators:
- Unusual patterns of users accessing phishing domains from LINE user-agent strings
Network Indicators:
- Increased traffic to suspicious domains from LINE app instances
SIEM Query:
Not typically applicable for client-side mobile app vulnerabilities.