Where are we standing regarding to the known vulnerability?

It seems it originates via custom emojis.. Does we even have any? I saw some saying that removing them helps for now.