EUVD-2026-52574
GHSA-86g4-8jpx-6pgq
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Network-reachable with no required attacker privileges; passive victim interaction (profile view) is the sole barrier; impact confined to the LINE app sandbox with no scope change.
Primary rating from Vendor (LY-Corporation).
CVSS VectorVendor: LY-Corporation
Lifecycle Timeline
2DescriptionCVE.org
A code injection vulnerability exists in the LINE Android app prior to version 26.7.2.
The profile rendering component does not adequately validate or sandbox externally supplied script content embedded in profile templates.
As a result, an attacker who is able to place crafted content in a profile could cause unintended code to execute with the application's privileges when a victim views that profile.
A server-side mitigation has been deployed that also protects existing Android clients that have not been updated to version 26.7.2.
AnalysisAI
Code injection in the LINE Android app (prior to version 26.7.2) allows an attacker who controls a LINE profile to embed malicious script content in profile templates, which executes with the app's full privileges when a victim views that profile. The CVSS 4.0 score of 8.7 reflects high confidentiality, integrity, and availability impact against the vulnerable system, with network-accessible, zero-privilege exploitation requiring only passive victim interaction. Critically, LY Corporation has deployed a server-side mitigation that protects even unpatched Android clients; no public exploit has been identified at time of analysis and no CISA KEV listing exists.
Technical ContextAI
The vulnerability resides in the profile rendering component of the LINE Android client (CPE: cpe:2.3:a:ly_corporation:line_client_for_android:*:*:*:*:*:*:*:*), developed and maintained by LY Corporation. The root cause is insufficient validation and sandboxing of externally supplied script content embedded in user profile templates - a code injection pattern where attacker-controlled data is treated as executable code rather than inert content. Although no CWE was formally assigned in this record, the behavior is consistent with CWE-94 (Improper Control of Code Generation) or template injection classes. The attack surface is the profile viewing flow within the Android application, where attacker-crafted profile data is fetched from LINE's servers and rendered locally without adequate sanitization. The server-side mitigation subsequently deployed suggests the injected content traverses LINE's backend before reaching the client, enabling server-side filtering as a chokepoint.
RemediationAI
Upgrade the LINE Android app to version 26.7.2 or later via the Google Play Store; this is the primary vendor-released client-side fix, confirmed at https://line.github.io/security-advisory-blog/CVE-2026-16881/. LY Corporation has independently deployed a server-side mitigation that sanitizes malicious profile content before it reaches unpatched clients, providing interim protection for devices that have not yet updated - this reduces urgency but does not eliminate the need for the client patch, as server-side controls can be bypassed by alternative delivery mechanisms or future configuration changes. For organizations managing Android devices via MDM, push the Play Store update to LINE 26.7.2 or later as a priority. No additional workarounds are necessary given the server-side control already in place, but restricting LINE profile visibility in enterprise deployments (if the platform supports it) would reduce exposure further while updates are deployed.
Same technique Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today