CVE-2025-14021
📋 TL;DR
The LINE iOS app's in-app browser has an address bar spoofing vulnerability that allows attackers to display trusted URLs while running malicious JavaScript in iframes. This enables phishing attacks where users see legitimate-looking URLs but interact with malicious content. Only iOS LINE app users with versions below 14.14 are affected.
💻 Affected Systems
- LINE for iOS
📦 What is this software?
Line by Linecorp
⚠️ Risk & Real-World Impact
Worst Case
Users could be tricked into entering sensitive credentials, financial information, or personal data into malicious forms that appear to be legitimate websites, leading to account compromise, financial loss, or identity theft.
Likely Case
Phishing attacks where users are tricked into clicking malicious links within LINE that appear to lead to trusted sites but instead capture login credentials or personal information.
If Mitigated
Users who verify URLs carefully and avoid clicking suspicious links would be protected, though the visual deception makes this difficult without the patch.
🎯 Exploit Status
Exploitation requires user interaction (clicking a malicious link) but the technical barrier is low once the malicious page is created.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 14.14 and later
Vendor Advisory: https://hackerone.com/reports/2548498
Restart Required: No
Instructions:
1. Open the App Store on your iOS device. 2. Search for 'LINE'. 3. Tap 'Update' if available. 4. Ensure version is 14.14 or higher.
🔧 Temporary Workarounds
Use External Browser
iosConfigure LINE to open links in Safari instead of the in-app browser
Avoid Clicking Links
allDo not click links within LINE messages, especially from unknown senders
🧯 If You Can't Patch
- Educate users to manually verify URLs by checking the actual address bar before entering any information
- Implement web filtering or URL analysis tools to block known malicious domains
🔍 How to Verify
Check if Vulnerable:
Check LINE app version in iOS Settings > LINE > Version. If below 14.14, you are vulnerable.Check Version:
Not applicable - check via iOS Settings appVerify Fix Applied:
Confirm LINE app version is 14.14 or higher in iOS Settings > LINE > Version.📡 Detection & Monitoring
Log Indicators:
- Unusual iframe loading patterns in web logs
- Multiple redirects to suspicious domains
Network Indicators:
- HTTP requests to known phishing domains from LINE user agents
- Suspicious JavaScript loading patterns
SIEM Query:
Not typically applicable for client-side mobile app vulnerabilities