Home

Description

Improper authorization in handler for custom URL scheme issue in "Yahoo! Shopping" App for Android versions prior to 14.15.0 allows a remote unauthenticated attacker may lead a user to access an arbitrary website on the vulnerable App. As a result, the user may become a victim of a phishing attack.

PUBLISHED Reserved 2025-08-29 | Published 2025-09-05 | Updated 2025-09-05 | Assigner jpcert




MEDIUM: 4.3CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

MEDIUM: 5.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Problem types

Improper authorization in handler for custom URL scheme

Product status

versions prior to 14.15.0
affected

References

jvn.jp/en/jp/JVN35290164/

cve.org (CVE-2025-41408)

nvd.nist.gov (CVE-2025-41408)

Download JSON