Line Client For Android
Monthly
Code injection in the LINE Android app (prior to version 26.7.2) allows an attacker who controls a LINE profile to embed malicious script content in profile templates, which executes with the app's full privileges when a victim views that profile. The CVSS 4.0 score of 8.7 reflects high confidentiality, integrity, and availability impact against the vulnerable system, with network-accessible, zero-privilege exploitation requiring only passive victim interaction. Critically, LY Corporation has deployed a server-side mitigation that protects even unpatched Android clients; no public exploit has been identified at time of analysis and no CISA KEV listing exists.
Code injection in the LINE Android app (prior to version 26.7.2) allows an attacker who controls a LINE profile to embed malicious script content in profile templates, which executes with the app's full privileges when a victim views that profile. The CVSS 4.0 score of 8.7 reflects high confidentiality, integrity, and availability impact against the vulnerable system, with network-accessible, zero-privilege exploitation requiring only passive victim interaction. Critically, LY Corporation has deployed a server-side mitigation that protects even unpatched Android clients; no public exploit has been identified at time of analysis and no CISA KEV listing exists.