Vulnerability · Published Aug 4, 2026 · Assigned by LY-Corporation
CVE-2026-16881
High 8.7
In plain English
A high-severity security flaw in LINE client for Android from LY Corporation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 39% of all known vulnerabilities).
Official description
A code injection vulnerability exists in the LINE Android app prior to version 26.7.2. The profile rendering component does not adequately validate or sandbox externally supplied script content embedded in profile templates. As a result, an attacker who is able to place crafted content in a profile could cause unintended code to execute with the application's privileges when a victim views that profile. A server-side mitigation has been deployed that also protects existing Android clients that have not been updated to version 26.7.2.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| LY Corporation | LINE client for Android | see references |