Read the docs
TI-2025-12812 Aliases CVE-2025-14021GHSA-h66v-gcx5-5fhw

The in-app browser in LINE client for iOS versions prior to 14.14 is vulnerable to…

Priority LOW 19CWE-451Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Spoofing
Confidentiality · integrity · availability
None · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-451.

Summary

The in-app browser in LINE client for iOS versions prior to 14.14 is vulnerable to address bar spoofing, which could allow attackers to execute malicious JavaScript within iframes while displaying trusted URLs, enabling phishing attacks through overlaid malicious content.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00212 11th percentileScored 2026-11-07
Fix Fixed LINE client for iOS (LINE Corporation): 14.14

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
LINE CorporationLINE client for iOS14.13 to before 14.1414.14Patch availableCNA
  • LINE client for iOS VendorLINE Corporation Affected 14.13 to before 14.14 Fixed in 14.14 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:linecorp:line:*:*:*:*:*:iphone_os:*:*before 14.14.0VulnerableLinecorp
  • cpe:2.3:a:linecorp:line:*:*:*:*:*:iphone_os:*:* Versions before 14.14.0 Vulnerable ·Linecorp

Remediation

  • Fix · CNA LINE client for iOS (LINE Corporation) Fixed in 14.14

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-14021
  2. 2026-10-03 Alias added: GHSA-h66v-gcx5-5fhw

References

Advisory 1

  • TI-2024-01613 Improper authentication in LINE Corporation Armeria CVSS 3.1CRITICAL 9.1
  • TI-2023-05112 Improper certificate validation in LINE client for iOS CVSS 3.1CRITICAL 9.8
  • TI-2024-01060 Cross-site scripting in LINE Corporation Central Dogma CVSS 3.1CRITICAL 9.3
  • TI-2023-19873 Paths contain matrix variables bypass decorators CVSS 3.1HIGH 7.5
  • TI-2022-19973 LINE client for iOS before 12.17.0 might be crashed by sharing an invalid shared key of e2ee in group chat. CVSS 3.1HIGH 7.5
  • TI-2021-15992 Missing authorization in LINE Corporation Central Dogma CVSS 3.1HIGH 8.8
See all 26 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences