CVE-2025-41408 Overview
CVE-2025-41408 is an improper authorization vulnerability in the custom URL scheme handler of the Yahoo! Shopping app for Android. Versions prior to 14.15.0 accept arbitrary URLs through the exposed scheme handler without adequate origin validation. A remote unauthenticated attacker can craft a malicious link that, once tapped, causes the app to load an attacker-controlled website inside the trusted app context. The resulting behavior enables phishing attacks against Yahoo! Shopping users. The issue is classified under [CWE-939: Improper Authorization in Handler for Custom URL Scheme].
Critical Impact
A remote attacker can lure Yahoo! Shopping users into loading arbitrary websites inside the app, enabling credential-harvesting and phishing campaigns that abuse the app's trusted UI.
Affected Products
- Yahoo! Shopping App for Android versions prior to 14.15.0
- Android mobile clients using the vulnerable custom URL scheme handler
- Users interacting with attacker-supplied deep links that invoke the app
Discovery Timeline
- 2025-09-05 - CVE-2025-41408 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-41408
Vulnerability Analysis
The Yahoo! Shopping Android app registers a custom URL scheme that other apps and web pages can invoke through Android intents or href links. When the app receives a URL via this scheme, its handler dispatches the target address to an in-app browser or WebView component. The handler fails to validate whether the destination belongs to a trusted domain allowlist before rendering the resource. An attacker exploits this by embedding a crafted scheme URL on a phishing page, a chat message, or an ad creative. The user only needs to tap the link inside a browser or messaging app for the flow to trigger. The attacker-controlled site then renders inside the Yahoo! Shopping app, inheriting the visual trust of a legitimate shopping context. Under CWE-939, the root defect is that the scheme handler treats externally supplied URLs as authorized destinations. The result is a targeted phishing surface that bypasses users' normal browser security cues such as the address bar and certificate indicators.
Root Cause
The custom URL scheme handler performs no authorization check on the URL parameter passed to it. Any origin outside Yahoo's controlled domains should be rejected or opened in the system browser, but the affected versions load them directly.
Attack Vector
Exploitation requires network delivery of a link and a single user tap. No credentials or prior access are required. The attacker hosts a page that invokes the vulnerable scheme with a phishing URL as its parameter, then distributes the page through email, social media, or malvertising.
See the JVN Security Advisory (JVN#35290164) for technical details published by the coordinator.
Detection Methods for CVE-2025-41408
Indicators of Compromise
- Outbound HTTP or HTTPS requests from the Yahoo! Shopping app process to domains outside yahoo.co.jp or other Yahoo-owned properties.
- Inbound deep links or intents referencing the Yahoo! Shopping custom URL scheme with a url or equivalent parameter pointing to third-party hosts.
- Phishing pages that embed anchor tags or JavaScript redirects targeting the app's custom scheme.
Detection Strategies
- Inspect mobile proxy or DNS logs for Yahoo! Shopping app traffic terminating at non-Yahoo domains shortly after a scheme invocation.
- Hunt in email and web gateway telemetry for URLs containing the app's custom scheme paired with encoded external URLs.
- Correlate user-reported phishing incidents with app version metadata to identify unpatched clients still running versions below 14.15.0.
Monitoring Recommendations
- Enable mobile threat defense telemetry to flag apps loading untrusted WebView content.
- Monitor enterprise mobile device management (MDM) inventory for the installed Yahoo! Shopping app version and alert on versions prior to 14.15.0.
- Track user reports of unexpected login prompts or payment pages appearing inside the Yahoo! Shopping app.
How to Mitigate CVE-2025-41408
Immediate Actions Required
- Update the Yahoo! Shopping Android app to version 14.15.0 or later through Google Play.
- Instruct users to avoid tapping Yahoo! Shopping deep links received from untrusted sources such as unsolicited email, SMS, or social media.
- Report suspected phishing pages abusing the custom scheme to Yahoo Japan and relevant browser vendors for URL blocklisting.
Patch Information
The vendor has released Yahoo! Shopping for Android version 14.15.0, which addresses the improper authorization in the custom URL scheme handler. Users should install the update directly from Google Play. Reference the JVN Security Advisory (JVN#35290164) for vendor-coordinated disclosure details.
Workarounds
- Uninstall the Yahoo! Shopping app on devices that cannot be updated to 14.15.0 or later.
- Restrict handling of the custom URL scheme through enterprise mobile policy, forcing links to open in a hardened browser instead of the app.
- Deploy phishing-resistant authentication and user awareness training to reduce credential loss when phishing pages render inside trusted app contexts.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
