CVE-2026-16881: Code Injection
A code injection vulnerability exists in the LINE Android app prior to version 26.7.2.
The profile rendering component does not adequately validate or sandbox externally supplied script content embedded in profile templates.
As a result, an attacker who is able to place crafted content in a profile could cause unintended code to execute with the application's privileges when a victim views that profile.
A server-side mitigation has been deployed that also protects existing Android clients that have not been updated to version 26.7.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
LINE Android appto a version that resolves this vulnerability.Fixed in 26.7.2 - Compensating control
Rely on the deployed server-side mitigation that protects existing Android clients not updated to version 26.7.2.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-16881?
CVE-2026-16881 has a risk rating of 60, indicating a moderate level of severity.
How do I fix CVE-2026-16881?
To fix CVE-2026-16881, upgrade the LINE Android app to version 26.7.2 or later.
What type of vulnerability is CVE-2026-16881?
CVE-2026-16881 is classified as a code injection vulnerability.
What is affected by CVE-2026-16881?
CVE-2026-16881 affects the LINE Android app prior to version 26.7.2.
How can an attacker exploit CVE-2026-16881?
An attacker can exploit CVE-2026-16881 by placing crafted content in a profile, which is not properly validated or sandboxed.