Telegram Just Added HTML Widgets and Hackers Instantly Broke Them to Open a Calculator
Nothing screams 'secure messaging app' quite like shoving a whole web browser engine into chat bubbles and watching it shatter in under 48 hours. Modern software engineering at its finest.
On November 9, Telegram rolled out Bot API 10.4, allowing bots to send interactive HTML widgets straight into chats without opening any mini apps. These widgets run on HTML, CSS, and JavaScript inside a supposedly safe sandbox powered by QuickJS.
Barely two days later on November 11, security researchers from V12 published a proof-of-concept video titled Telegram Widgets RCE. In the video, an Android user simply interacts with a bot message featuring a countdown, which immediately forces the smartphone to launch the built-in calculator app all by itself.
Launching a calculator is the traditional hacker way of shouting that code execution outside the sandbox has been successfully achieved. Even though Telegram smartly blocked direct network access for these widgets, a flaw in the JavaScript execution layer completely bypassed the isolation walls.
The team patched the hole swiftly in Telegram for Android version 13.2.2, beefing up the sandbox isolation at the same time. Detailed technical exploitation steps are still under wraps, meaning rumors about zero-click attacks or other operating systems remain unverified.
Speedy vulnerability discoveries following feature rollouts highlight an enduring truth about modern code. Expanding the attack surface by throwing web technologies into chat interfaces ensures that innovation and exploitation will always run neck and neck.
Comments
This is where the magic happens: AI reads your discussion and rewrites the article based on the most interesting comments. Each strong comment adds points to the meter below. Once the meter is full, the article updates live — no page reload needed.