World Favorites Increased (for VRC+ Subscribers!) to 800!
Likewise, we tossed in some QoL changes for Favorites!
Group Progress Bar A/B Test!
Group Auto Invites!
Live Now + Mutuals are live for everyone!
A new “Error World!”
…and many more fixes!
This patch also enabled the third-person experiment, so there’s a chance (if you’re on desktop) that you might see it.
February 2026 (Valentine’s Day!) Shop Update!
A few hours ago, we pushed an update to the Shop! You can see more here:
This update also means all VRC+ Subscribers get a new Item! It’s the Love Me Daisy! You know, for seeing if your special someone really does love you this Valentine’s Day.
Group Public Instances Fix
For a while now, malicious actors jerks have been able to open up Group Public instances for groups that they’re not a member of. We fixed it!
People can still go back to “old” group instances that weren’t closed. This is by design. If you’re running Group instances and you want to make sure that instance can’t be “revived” by someone going back to it later on, make sure you click Close Instance before you leave.
Creator’s Improvements
More bug fixes!
For a while now, the enabled and isActiveAndEnabled properties defined by all Unity behaviors have only been whitelisted to Udon for specific individual types. In a future SDK release, we’ll whitelist these two properties on everything that’s derived from Unity’s Behavior class, which will hopefully make it much easier to use them on a behaviour where you don’t know what its specific type is at compile time.
We’re adding a new option to the state machine behavior VRCAvatarParameterDriver to allow it to pick values in a random order without ever picking the same value twice in a row. This was added to make it consistent with VRCAnimatorPlayAudio, which already supports randomly selecting clips without repeating them twice in a row.
Website Updates
A few updates from the VRChat Web Team this week!
Did your group’s events page go quiet for a bit? We fixed a bug that prevented them from showing up. Sorry about that!
We’ve made several improvements to tools for creators, including the payout system.
Added support for VRC+ members changing their display name once per month rather than once every three months.
Added support for newly-expanded VRC+ world favorites.
ok bye
That’s it for this week! See you in two more weeks, on February 19!
I’d like to add that this would be a temporary fix. We would love to see a true MacOS port in the near future. The ground work has been achieved with the iOS version.
As the person who made that private exploit report and the public Canny, the only communication I got over a year and a half was “We do not guarantee a response other than the automated “ticket received” notification.” and the Canny being marked as tracked, which simply means it was put on the internal bug tracker, not that any action was being taken.
I’ve recently escalated another exploit in which remote users can launch a browser session without your action or consent and can DoS your device through memory exhaustion by doing so. It’s not even marked as tracked.
VRChat really needs to re-consider how they publicly approach security and transparency of it with their users. I am appreciative of the fact that this the group public exploit was finally fixed, but the lack of communication and the extremely long time that this exploit was left open leaves much to be desired.
That’s a link to the horses mouth, but yes still on that 2022 version. It’s been my experience that engine updates are well telegraphed, and the moment that they fully migrate, the Creator companion and SDK will not be quiet.
