What’s Vulnerable › Vulnerabilities
CVE-2026-16881
- Severity: high (CVSS 8.7 v4.0)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.4% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-08-04 · updated 2026-10-23
Description
A code injection vulnerability exists in the LINE Android app prior to version 26.7.2. The profile rendering component does not adequately validate or sandbox externally supplied script content embedded in profile templates. As a result, an attacker who is able to place crafted content in a profile could cause unintended code to execute with the application's privileges when a victim views that profile. A server-side mitigation has been deployed that also protects existing Android clients that have not been updated to version 26.7.2.
Affected products
- LY Corporation LINE client for Android: all versions — fixed in 26.7.2
How to fix
Upgrade to a fixed version: LY Corporation LINE client for Android 26.7.2. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-16881 or the next vulnerability affects your stack