Code Injection Vulnerability in LINE Android App by LINE Corp

CVE-2026-16881

What is CVE-2026-16881?

A code injection vulnerability has been identified in the LINE Android app, affecting versions earlier than 26.7.2. This vulnerability arises from inadequate validation and sandboxing of externally supplied script content within profile templates. An attacker can exploit this flaw by embedding malicious scripts in a profile. When the profile is viewed by a victim, the crafted content could execute unintended code with the application’s privileges, potentially compromising user data and security. LINE Corp has implemented a server-side mitigation to safeguard both updated and non-updated Android clients from potential exploitation.

References