Telegram curbs new in-chat apps amid a no-tap hacking scare
Telegram has blocked ordinary bots from sending its new interactive in-message apps, known as HTML widgets, even in private chats, after researchers reported potential flaws.
Telegram has restricted general bots from using HTML widgets, a new feature that allows interactive content inside messages, including private chats. The restriction was confirmed by levlam, a contributor to the Telegram Bot API repository, in response to a developer's report of an error.
The feature, introduced with Bot API 10.4 on November 9, enables widgets to run code on a user's device within an isolated environment. It is designed to connect directly to a user's TON wallet, handling signed data or transaction notifications, which has raised interest among crypto users.
Telegram's Bot API changelog still listed private-chat production availability on November 14, despite the restriction. The confirmation applies only to HTML widgets and does not affect ordinary bot messages or all bot services.
Security research
Researchers at tg-widget-rce reported that the feature could allow code execution during chat layout without a tap, a vulnerability they say affects older app builds. Their findings were published in an archive that includes Android builds, Telegram for iOS 13.2, Telegram Desktop 7.4.0, and Telegram for macOS 13.1.
The researchers distinguish between app-level code execution on selected older Android builds and results contained in an isolated widget process on other versions. They emphasize that a widget-process result does not establish control of the whole device and that delivery requires a bot permitted to send widgets.
Yes, currently, general bots aren't allowed to use widgets even in private chats.
The researchers state that the vulnerabilities they published are fixed in current Telegram builds and do not establish a definitive minimum safe version for every client. They also note that their demonstrations do not establish stolen crypto assets or widespread malicious exploitation.
Durov's response
Telegram founder Pavel Durov denied that merely receiving a message could compromise users. He said users first had to start a third-party service and asserted that the issue was fully patched server-side.
Durov's assurance is Telegram's stated position, while the researchers' demonstrations do not establish widespread malicious exploitation. The restriction confirmation does not specify existing-widget rendering or restoration timing, leaving uncertainty about the status of widgets already delivered to users.
Related
