LINE for Android: viewing a profile could run code (CVE-2026-16881)

The Android version of LINE has a flaw that lets code run with the app's own privileges simply because you looked at someone's profile. Its developer, LY Corporation, disclosed it on August 4, 2026. The identifier is CVE-2026-16881, and the company rates it 8.7 out of 10.

The conclusion first. The fix already shipped. It landed in version 26.7.2, a build from early summer this year. The copy of LINE distributed on Google Play was updated again on July 14, 2026, which means anyone who has left automatic updates switched on is already past the fixed version.

The company also says it deployed a server-side mitigation that protects Android clients which have not been updated. There is no report of the flaw being used in an attack, and no exploit code in circulation.

It is still worth writing down, because LINE passed 100 million monthly users in Japan (as of the end of December 2025). For anyone who turns automatic updates off, who has not touched a device in a while, or who looks after a family member's older phone, the check is worth making. Here is what the flaw does, whether it applies to you, and where to look.

Who would target this, and why

The people who benefit from a flaw like this are those who can approach large numbers of LINE users on their own initiative. Scam operations that pose as new contacts, and outfits that prepare accounts in bulk and wait, are the obvious cases. Nobody breaks into your phone here — instead, you go and look at their profile.

What they do is simple: plant crafted content in their own profile so that anyone who views it runs the attacker's instructions inside LINE. Profiles appear all over ordinary use — the confirmation screen when someone adds you, chat lists, group member lists. No file needs to be sent, no link needs to be tapped. Seeing a name, wondering who it is, and tapping it is enough.

What stands to be lost? The instructions run within LINE's own privileges. Put the other way round, within that boundary, chats, contacts and the account itself are reachable. What this is not is a takeover of the whole phone or a route into other apps. That line is drawn clearly in the vendor's own scoring, which the technical section below unpacks. For a company running an official LINE account, the reading is that an employee's handset can be the way in.

What the flaw actually is

A LINE profile screen is not just a name and an icon. It assembles what the user has configured — background images and video, decoration, a status message — and draws the result. The problem sat in that assembling-and-displaying step.

According to the vendor's advisory, script content supplied from outside and embedded in profile templates was neither validated adequately nor sandboxed. The place where "this is text to display, not an instruction to run" should have been enforced was not enforcing it.

The result: displaying a maliciously built profile caused the planted instructions to execute with the LINE app's own privileges. The technical name for this class is code injection — slipping instructions into data that was only ever meant to be shown — catalogued as CWE-94.

From a user's point of view, the awkward part is that it can happen without doing anything that felt risky. No attachment is opened, no external site is involved. Only an ordinary action that stays inside the app is required.

Does this apply to your phone?

Two questions decide it: is it Android, and is LINE at 26.7.2 or later. Find your row below.

In practice, most Android users are already out of scope. 26.7.2 is an early-summer build, and 26.8, 26.9, 26.10 and 26.11 have shipped since. Google Play records LINE as updated on July 14, 2026. If automatic updates have been left on, that version was passed long ago.

The people who should check are those who deliberately turned automatic updates off and those with devices that have sat unused. Data-saving setups and old handsets kept for a child or an older relative are exactly where an early-summer build can still be sitting.

Checking your version and updating

Your installed version is visible inside the app. Open LINE, tap the gear icon at the top right of the Home tab, and open "About LINE" at the bottom — the current version is shown there.

Updating happens on the Google Play listing. If an "Update" button is showing, press it; if not, you are current. It is worth checking the auto-update setting while you are there: in the Play Store app, tap your profile icon, then Settings, then Network preferences, where you can choose the conditions for updating apps automatically.

LY Corporation also states that, separately from the app update, it deployed a fix on the server side. Its wording is that this "also protects existing Android clients that have not been updated to version 26.7.2," which offers some cover to people who cannot update. However, the date that mitigation went live has not been published. If you can update, updating is the certain route.

The technical view

The vendor assigned CVSS 4.0 8.7, rated HIGH. Reading the components makes the shape of the flaw clear.

The last row is the one to read. The impact is assessed as not leaving the app. Android partitions each app into its own space, and the judgement is that code running inside LINE does not cross that wall. That is the basis for saying this is not a "your whole phone is taken over" story.

One more thing worth spelling out is how to read "no privileges required" (PR:N). It means the victim does not need to be signed in — not that the attacker needs nothing. To plant content in a profile, the attacker needs a LINE account. That precondition is not reflected in the score, so the real-world effort is a little higher than the number suggests.

Note that the US National Vulnerability Database has not issued its own assessment yet. As of August 4 its status is "received, not analysed," and the 8.7 on display is the vendor's declared figure carried through. An empty NVD field does not mean "minor." The developer itself put this at 8.7 out of 10.

What is still unknown

The disclosure was extremely short. Several things are simply not in it.

First, how long the flaw existed. The advisory says only "before 26.7.2" and gives no lower bound. Whether this dates back a year or arrived shortly beforehand cannot be determined.

Second, the status of the iPhone and desktop versions. Profile rendering exists on every platform, but the advisory addresses only Android. It does not say the others are unaffected — it says nothing about them. Where this article marks them as out of scope, that means only "absent from the advisory."

Third, when the fixed build shipped. No release date is given. From the timing of neighbouring versions (26.7.0, 26.7.1, 26.8.0), the 26.7 line belongs to the late-May to early-June generation. But 26.7.2 itself could not be found in the public app-distribution archives. A staged rollout could explain a build going unrecorded, but there is nothing here to state as fact.

There is also no credit to a reporter and no timeline from discovery to fix. We will add these to this article as they become clear.

This is not the July "iPhone freezes" issue

In mid-July, a LINE vulnerability was reported widely in Japan: opening a link in LINE for iPhone could freeze the screen (CVE-2026-3861). That is a separate matter. Because the two are easy to confuse, here is the difference.

July's issue only froze things temporarily and could not expose chat contents. This one runs code with the app's privileges, so it is heavier in nature. On remediation, though, this one is in better shape. July's case drew an advisory from JVN, Japan's national vulnerability database, and a wave of coverage; as of August 4, this one has neither a JVN entry nor any Japanese-language reporting.

Frequently asked questions

I saw the severity field left blank. Does that mean it is minor?

No. The US National Vulnerability Database simply has not worked through it yet, and the vendor's declared 8.7 sits on that same page. This is normal for a vulnerability on its day of publication.

Is avoiding friend requests from strangers enough?

It helps, but updating the app is the reliable answer. Profiles show up in more places than the friend-request screen — group member lists, for one. Updating closes the entrance entirely.

Can I check whether I was already hit?

No user-facing indicators have been published, and no exploitation has been reported. If you want reassurance, review the devices currently logged in from LINE's settings and look for anything unfamiliar.

Is it on the US list of exploited vulnerabilities?

It is not. We checked the catalogue of vulnerabilities confirmed to be under attack (KEV) in its August 3, 2026 version and this identifier is absent. You can follow listings on our CISA KEV dashboard.

An old phone cannot update through the Play Store.

The vendor states it deployed a server-side mitigation covering clients that have not updated. The advisory says nothing further than that. Where a device can be updated, updating is the certain route.

Summary

LINE for Android carried a flaw where displaying a crafted profile ran code with the app's privileges. At 8.7 by the vendor's own rating, it is not a minor issue. But the fixed build 26.7.2 shipped in early summer, so anyone with automatic updates on is already covered. A server-side mitigation is also in place, and no exploitation has been observed.

The task is to open the Play Store and see whether LINE is showing an "Update" button. That is all. If it is not showing one, there is nothing to do. Unlike flaws in the phone hardware itself, where you wait on a carrier or replace the device, this one is finished by hand in under a minute.

If anything deserves attention, it may not be your own phone but a relative's. Handsets running for years with automatic updates disabled are closer to hand than people assume. We will update this article if a JVN entry, Japanese coverage, or word on the iPhone and desktop versions appears.

Sources

• ▸LY Corporation - Security advisory for CVE-2026-16881 (August 4, 2026)
• ▸NVD - CVE-2026-16881
• ▸CVE.org - CVE-2026-16881 record
• ▸Google Play - LINE (Android listing)
• ▸CISA - Known Exploited Vulnerabilities Catalog (checked against the August 3, 2026 version)
• ▸LY Corporation - LINE passes 100 million monthly users in Japan (January 29, 2026)
• ▸JVN - Japan Vulnerability Notes