WeChat Custom Browser Vulnerability Could Enable Remote Code Execution
Summary
Talos found that WeChat versions up to 8.0.42 used a vulnerable custom browser component. A malicious link could trigger CVE-2023-3420, enabling arbitrary code execution; users are advised to update WeChat and its XWalk component.
Key points
- WeChat’s custom XWalk WebView included an outdated V8 engine vulnerable to CVE-2023-3420.
- Talos confirmed WeChat versions up to 8.0.42 were affected, but could not verify patch status across all versions because WebView updates load dynamically.
- The vulnerability was seen exploited in the wild and could be triggered when a victim clicked a malicious link in a WeChat message.
- Successful exploitation could allow an attacker to control the victim’s device and execute arbitrary code.
- Tencent acknowledged the report and said it was working on a patch; WeChat 8.0.48 was released on the Play Store on June 14, 2024.
- Talos advised users to update WeChat and confirm XWalk is updated, or open links in an updated external browser instead.
Article Details
- Vulnerability Types
- Type confusion
- Severity
- CVSSv3 8.8
- Affected Versions
- WeChat versions up to 8.0.42 were confirmed vulnerable; Talos could not confirm patch status across all versions because of dynamic WebView loading.
- The affected custom WebView uses V8 version 8.6.365.13.
- Exploitation Status
- active
- Exploit Availability
- unknown
- Patch Status
- unknown
- Workarounds
- Do not click links sent over WeChat when using an impacted version.
- Copy links from WeChat and open them in an updated browser outside the application.
- Update WeChat to the latest version and confirm that XWalk is updated as well.
CVE
People
Aleksandar NikolicCisco Talos researcher and article author.Ashley ShenCisco Talos researcher and article author; also credited as Chi En Shen.Chi En ShenCredited Cisco Talos researcher; identified in the article as Ashley Shen.Michael GentileCredited for the research.Vitor VenturaCisco Talos researcher and article author.
Vendors
Products
V8While this issue, CVE-2023-3420, was disclosed and patched in the V8 engine in June 2023, the WeChat Webview component was not updated, and still remained vulnerable when Talos reported to the vendor in April 2024. WeChatVulnerability in Tencent WeChat custom browser could lead to remote code executionXWalkcomponent instead of relying on the built-in Android WebView. This component is a custom version of XWalk, maintained by Tencent, which consists of an embedded Chromium browser with V8 version 8.6.365.13 released