References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [email protected].

Change History

A code injection vulnerability exists in the LINE Android app prior to version 26.7.2. 

The profile rendering component does not adequately validate or sandbox externally supplied script content embedded in profile templates. 

As a result, an attacker who is able to place crafted content in a profile could cause unintended code to execute with the application's privileges when a victim views that profile. 

A server-side mitigation has been deployed that also protects existing Android clients that have not been updated to version 26.7.2.

AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

https://line.github.io/security-advisory-blog/CVE-2026-16881/

[{"vendor":"LY Corporation","product":"LINE client for Android","defaultStatus":"affected","versions":[{"version":"26.7.2","lessThan":"*","versionType":"custom","status":"unaffected"}]}]