LIFF SDK CVE-2026-112148

Exploitation requires three concrete conditions drawn from the advisory: (1) the target application must be built on LIFF SDK version 2.20.0 through 2.31.0; (2) the victim must actively open an attacker-crafted URL (UI:A) - the attack is not drive-by and depends on social engineering; and (3) the URL must be opened in an EXTERNAL browser rather than the in-app LINE environment, which is the specific deployment context that triggers the DOM-based sink. Impact is further limited to data and actions reachable from the LIFF app origin: the attack is only valuable where authentication tokens or sensitive data are JavaScript-accessible in that origin. These factors - mandatory user interaction and the external-browser condition - materially reduce real-world exploitability below what the network attack vector alone would suggest.

This is a genuinely medium-severity issue, not an inflated high-CVSS alarm. The vendor-supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:A) scores 5.1, and the metrics are internally consistent with the description: network-reachable, low complexity, no privileges, but requiring active user interaction (the victim must open a specially crafted URL in an external browser). The impact is deliberately scoped to the subsequent system (SC:L/SI:L) with no direct impact on the LIFF SDK itself (VC:N/VI:N/VA:N), reflecting that the harm lands in the hosted LIFF application's origin rather than the SDK runtime. No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The practical risk is bounded by the UI:A requirement (social-engineering a user into clicking a crafted link) and by whether a given LIFF app exposes JavaScript-accessible tokens, but DOM XSS in the origin of an authenticated messaging-platform mini-app is a meaningful token/session-theft vector. Treat as a prompt-patch item for developers shipping LIFF apps, but not an emergency given the interaction requirement and absence of exploitation signals.

An attacker crafts a malicious URL targeting a LIFF application built on a vulnerable SDK version (2.20.0-2.31.0) and lures a victim into opening it in an external (non-LINE) browser via phishing or a shared link. The DOM-based XSS executes attacker-controlled JavaScript in the LIFF app's origin, letting the attacker exfiltrate JavaScript-accessible authentication tokens and application data or perform unauthorized actions under the victim's session. No public POC is referenced, so weaponization would require independent exploit development against the specific sink.