Webview address bar spoofing in LINE client for iOS

Summary

When navigation to an invalid hostname occurs, the address bar is updated even though the navigation is cancelled. Due to this incorrect timing of updating the address bar and applying URL normalization, it can be recognized as a different hostname from the actual hostname. As a result, attacker may deceive the user to be browsing a legitimate site when the in-app browser is actually on a phishing site.

In the internal browser of the LINE iOS application, there was a flaw in the implementation of displaying the address bar of HTTP redirect processing. It was improperly normalized by inserting malicious Unicode character into the domain name. As a result, the domain name and the content of the displayed web page did not match, and Address Bar Spoofing was possible.