GoPlus Security reported that Telegram's HTML widgets feature carries a remote code execution risk, demonstrated through bot messages on Android and Desktop. Telegram has rolled out some fixes, but coverage remains incomplete, with potential bypasses still possible, particularly on PC. Researcher @v12sec showed an RCE working on the patched Windows client and said unsandboxed QuickJS in messages widens the attack surface. GoPlus instructs users to avoid unknown bots, not click "Start," and not open unfamiliar chats or suspicious links, trusting only verified channels. Once a complete fix is confirmed, users should update to the latest Telegram version, GoPlus said.

AI summary of the linked source — not editorial content.

Explore the topic

Loading related coverage…

Explore the full feed

Comments

Loading comments…