September 10, 2026 — If you use WeChat, you may have seen alarming headlines this week: a security flaw that lets an attacker hijack your account with a single voice call — no answer required. The vulnerability is real, but the good news is that Tencent has already fixed it — both on the server side and through app updates released in late August [citation:1][citation:7].

Here's everything you need to know about the WeWorm vulnerability, what Tencent has done to protect you, and why you should still update your app [citation:1][citation:9].

What Happened: A Phone Call That Could Hijack Your Account

The vulnerability, dubbed WeWorm by security firm Calif Research, was a memory corruption issue in WeChat's VoIP protocol stack — the code that handles incoming call setup and audio data [citation:3][citation:7].

What made this flaw particularly dangerous was its zero-click nature. According to Calif's demonstration [citation:1][citation:7]:

• The attacker only needed to place a WeChat voice call to the victim
• The victim did not need to answer the call or interact with their phone in any way
• The exploit completed within seconds — while the phone was still ringing
• After taking control, the attacker could read and send messages, make calls, and act as the victim
• The compromised account could then call the victim's contacts and repeat the process, creating a worm-like chain of infection [citation:9][citation:10]

Calif demonstrated the attack using three phones: a Pixel 10a called an iPhone 17e, compromised it while the call was still ringing, and the infected iPhone then called another Pixel 10a and did the same thing [citation:1][citation:10].

The Timeline: From Discovery to Fix

Calif Research used AI to find the vulnerability and develop the exploit. According to their disclosure, the entire process from discovery to working worm took about nine days — work that would previously have taken a larger team months to complete [citation:1][citation:7].

Here's the complete timeline of what happened [citation:1]:

Tencent told multiple media outlets that it had no evidence the vulnerability was ever exploited and no reason to believe any user accounts were affected [citation:8][citation:14].

What You Should Do Now

Even though Tencent has mitigated the threat on its servers, there are still good reasons to update your WeChat app [citation:3][citation:7].

Step 1: Check Your Version and Update

The minimum safe versions are:

• iOS: WeChat 8.0.76 or later
• Android: WeChat 8.0.77 or later

According to IT之家, WeChat iOS version 8.0.78 is now available on the App Store. The official release notes describe the update as “fixing some known issues,” but security enhancements are included [citation:6][citation:12].

Step 2: Check for Suspicious Activity

If you notice any of the following, take immediate action [citation:7]:

• Unexplained login attempts or new devices on your account
• Messages you didn't send appearing in your chats
• Calls to contacts you didn't make
• Friends receiving calls from you that you didn't initiate

If any of these occur, change your WeChat password immediately and review your logged-in devices in “Account & Security” settings.

Step 3: Stay Informed

Calif Research plans to present a full technical analysis of the vulnerability at an upcoming security conference [citation:1][citation:3]. For now, the immediate threat is contained — but this incident highlights broader questions about AI-assisted vulnerability discovery and the speed at which exploits can be developed in 2026 [citation:3].

Key Takeaways