Published:2025/09/05  Last Updated:2025/09/05

JVN#35290164
"Yahoo! Shopping" App for Android fails to restrict custom URL schemes properly

Overview

"Yahoo! Shopping" App for Android provided by LY Corporation fails to restrict custom URL schemes properly.

Products Affected

  • "Yahoo! Shopping" App for Android versions prior to 14.15.0

Description

"Yahoo! Shopping" App for Android provided by LY Corporation contains the following vulnerability.

  • Improper authorization in handler for custom URL scheme (CWE-939)
    • CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N Base Score 5.3
    • CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N Base Score 4.3
    • CVE-2025-41408

Impact

A remote unauthenticated attacker may lead a user to access an arbitrary website on the vulnerable App. As a result, the user may become a victim of a phishing attack.

Solution

Update the application
Update the application to the latest version according to the information provided by the developer.

Vendor Status

Vendor Status Last Update Vendor Notes
LY Corporation Vulnerable 2025/09/05

References

JPCERT/CC Addendum

Vulnerability Analysis by JPCERT/CC

Credit

Shiga Takuma of BroadBand Security, Inc. reported this vulnerability to IPA.
JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.

Other Information

JPCERT Alert
JPCERT Reports
CERT Advisory
CPNI Advisory
TRnotes
CVE CVE-2025-41408
JVN iPedia JVNDB-2025-000071