LINE Android CVE-2026-16881

The victim must view the attacker's LINE profile within the LINE Android app on a device running LINE prior to version 26.7.2. The attacker requires a LINE account with sufficient permissions to set a profile (standard account creation - no elevated role needed). User interaction is required: the victim must actively navigate to or be directed to the attacker's profile page. The server-side mitigation deployed by LY Corporation limits exploitation by filtering malicious profile content before delivery to the client, meaning unpatched clients are protected as long as the server-side control remains active. Exploitation is bounded to the LINE app's sandbox - direct device-level code execution outside the app is not indicated by available data. No network-level filtering bypasses are needed since the attack is social-engineering-driven (attacker shares a profile link).

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N) scores 8.7 and characterizes a network-reachable, low-complexity attack requiring no privileges on the target, with passive user interaction as the sole barrier - a realistic condition given that users routinely view profiles in messaging apps. All three impact dimensions are rated High against the vulnerable system. No EPSS score was provided, so probabilistic exploitation likelihood from threat intelligence feeds is unavailable. No CISA KEV listing exists at time of analysis, and no public exploit code has been identified. The single largest risk-reducing factor is the vendor-confirmed server-side mitigation already in production: LY Corporation explicitly states this protects existing Android clients that have not updated. This transforms the unpatched-client risk from high urgency to medium, though the client-side fix should still be applied to close the vulnerability permanently. CVSS scope is Unchanged, confirming exploitation is bounded within the LINE app sandbox - device-level compromise is not directly indicated.

An attacker registers a LINE account and populates their profile with a crafted template embedding malicious script content. The attacker then initiates contact with a target user, shares their profile link, or relies on social engineering to cause the victim to navigate to the malicious profile within the LINE Android app on a device running a version prior to 26.7.2. Upon rendering the profile, the unsandboxed script executes within the LINE application's process, potentially exfiltrating stored messages, session tokens, or contact data accessible to the app.