This vulnerability (CWE-94) affects the LINE client for Android versions before 26.7.2. The profile rendering component fails to adequately validate or sandbox externally supplied script content embedded in profile templates. Consequently, an attacker able to insert crafted content into a profile can trigger execution of arbitrary code with the application's privileges upon profile viewing. Although no official patch or remediation level is stated, LY Corporation has deployed a server-side mitigation that protects existing Android clients that have not been updated to version 26.7.2.

Successful exploitation could allow an attacker to execute arbitrary code within the context of the LINE Android app, potentially leading to unauthorized actions or data access. The vulnerability requires the attacker to place crafted content in a profile and the victim to view that profile. The CVSS 4.0 score of 8.7 reflects high impact with network attack vector, low attack complexity, no privileges required, and user interaction needed.

A server-side mitigation has been deployed by LY Corporation that protects existing Android clients even if they are not updated to version 26.7.2. Users are advised to update to version 26.7.2 or later when possible. Since the vendor has implemented a server-side fix, no immediate action is required for unpatched clients, but updating the app remains best practice.