LINE Developers disclosed on October 20, 2026, that older LIFF SDK versions carry a cross-site scripting flaw, and will restrict them around November 24. Any LINE MINI App or LIFF app on SDK v2.20.0–v2.31.0 is affected — ordering, booking and loyalty mini-apps many Thai businesses run inside LINE.
What LINE Disclosed
An outside researcher reported the flaw through LINE’s vulnerability program. Opening an affected app in an external browser from a malicious link could let an attacker run JavaScript on the app’s domain, exposing access tokens and on-screen data. LINE hasn’t confirmed a successful attack, but “cannot completely guarantee” no impact everywhere, and says disclosing the flaw itself raises the risk someone tries to exploit it.
The November 24 Cutoff Can Move Earlier
LINE fixed this in LIFF v2.31.1 (September 30); current is v2.31.2. Around November 24 it plans to restrict apps still on v2.20.0–v2.31.0 — its own notice warns that date “may be moved forward without prior notice.” Once restricted, an affected app opened in an external browser may lose LINE Login or other LIFF features, or stop working. LINE’s own wording: “Usage restrictions alone cannot completely eliminate the vulnerability risk” — the fix is updating now, not waiting out the deadline.
What to Check Before November 24
- Ask whoever built or manages your LINE MINI App — in-house or an agency — which LIFF SDK version it runs, and whether it’s been bumped to v2.31.2.
- CDN “edge path” integrations auto-update, LINE says; a “fixed path” or npm install (
@line/liff) needs a manual bump. - Today, open your ordering, booking or loyalty mini-app from a LINE chat link in an external mobile browser and confirm it loads — don’t wait until November.
- If an agency maintains the mini-app under a contract, this is a dated reason to get written confirmation, not a general “we keep things current.”
It’s the second LINE MINI App policy change in two weeks, after LINE restricted in-app ads to one network — if that needed a check, so does this, and so does a LINE OA profile mid-change the same month.
