Affected Systems
WeChat versions prior to 8.0.77 (Android) and 8.0.76 (iOS) on iPhone and Android devices. Tested vulnerable versions: WeChat 8.0.76 (Android) and 8.0.75 (iOS). Affects an estimated 1.439 billion monthly active users globally. Status of Windows, Mac, Linux, and HarmonyOS clients unknown.
Exploitation Status
No active exploitation reported. Proof-of-concept worm demonstrated by Calif researchers in controlled environment. Flaw reported to Tencent in July 2026; server-side mitigation deployed by August 28, 2026. Technical details withheld pending conference presentation. No CVE assigned.
Business Impact
Zero-click vulnerability allows full WeChat account takeover without user interaction during incoming calls from existing contacts. Attacker gains ability to read/send messages, make calls, access payments, and control mini-programs within WeChat. Worm-capable exploit spreads contact-to-contact. Tencent deployed server-side blocks effective for all users regardless of client version, but underlying vulnerability fix status unconfirmed. No forensic indicators published; organizations cannot detect prior compromise or identify affected call logs.
Urgency
🟠Within 24 hours
Recommended Actions
- Update all WeChat installations to version 8.0.77 (Android) or 8.0.76 (iOS) or later immediately, despite server-side mitigation claims
- Audit WeChat usage in corporate environments and assess risk tolerance given lack of CVE, advisory, or confirmed root-cause fix from Tencent
- Monitor for unusual WeChat account activity including unexpected message sends, payment transactions, or contact additions during late July through August 2026
- Restrict or prohibit WeChat use on devices handling sensitive communications until Tencent publishes full advisory and confirms vulnerability remediation
- Review security posture of Windows, Mac, Linux, and HarmonyOS WeChat clients; contact Tencent for clarification on affected platforms