Telegram HTML widgets had an Android remote code execution bug
Researchers at V12 showed that Telegram's new in-chat HTML widgets could be used to run code remotely on Android. The company has already shipped a fix.
SUMO· the number puzzle
Dialo· learn languages by speaking
ediviewer· read EDI files like documents
giftdetect· the right gift in minutesTelegram's brand-new interactive widgets had a serious hole within days of launch. Security researchers at V12 demonstrated a Telegram RCE vulnerability, meaning remote code execution, in the Android app. Telegram has already released a fix.
The feature in question arrived on 9 November with Bot API 10.4. It lets bots send interactive HTML widgets straight into a conversation. Unlike Mini Apps, which open as a separate app, these widgets live inside the chat itself. They support HTML, CSS and JavaScript, and the JavaScript is meant to run in an isolated QuickJS environment, a small JavaScript engine used as a sandbox.
According to the researchers, that isolation was not enough to keep the code contained on Android. The summary we have does not say how the exploit worked, so those details are not covered here.
What is remote code execution?
Remote code execution means an attacker can make your device run code they chose, from a distance. It is among the most serious kinds of bugs, because it can start from something as ordinary as a message arriving in a chat.
Is Telegram on Android safe now?
The developers have released a patch, so the practical advice is simple: update Telegram on Android to the latest version. The flaw affected the Android app specifically, according to the researchers.
The timeline is short. The widgets were introduced on 9 November, and the research was public by 11 November. New features that run code inside a chat are an attractive target, and this one was tested quickly.
Apps worth a look
SUMO: the number puzzleTap the right tiles, add them up, hit the target. Easy to learn, hard to master. Free, for all ages.
Dialo: learn languages by speakingTalk to an AI conversation partner; every sentence comes back corrected and explained in your language. 9 languages, A1 to C2.
ediviewer: read EDI files like documentsOpen EDIFACT and X12 messages, see every segment explained, convert to JSON/XML, export PDF and Excel. Runs locally, no upload.
giftdetect: the right gift in minutesPick who it is for, the occasion and their personality. The search engine reads product descriptions from local shops and ranks what fits. Free, no sign-up.
More from this day
See all →
Rubik's Cube production returns to Hungary with a robot line
AI shopping tips: Perplexity sent users to fake stores in 15% of answers
Starship Flight 15: SpaceX Will Try to Catch Both Stages
