Telegram has fixed a remote code execution flaw in its Android app, according to a report published by SecurityOnline on November 12. Security firm V12 posted a video on November 11 titled “Telegram Widgets RCE,” with a SHA-256 hash but no technical write-up. In the demo, a user sends /start to a bot, the bot replies with an image, and the phone’s Calculator app opens a few seconds later, which suggests code ran on the device.
Widgets are a newer Telegram bot feature. Telegram’s developer documentation describes them as small interactive blocks inside a bot message, written in HTML and JavaScript and run in the QuickJS engine rather than a browser view. The page says widgets have no network access and are rolling out in steps, currently working in private chats with a bot in production. V12 has not named the failing component; posts on X point to a QuickJS bug, which is unverified.
SecurityOnline reported that Telegram confirmed on X that the bug “was fixed yesterday” and that the fix reached all users. It added that no CVE has been assigned, no attacks in the wild have been reported, no vulnerable or patched version number has been published, and it is unclear whether iOS or desktop clients are affected.
Users should update the Android app and avoid starting unfamiliar bots.
Track the market yourself with AiTraderView’s FREE tools: Crypto Cockpit for charts and 75+ indicators, Crypto Screener to find setups, and Crypto Portfolio to follow your holdings. Just create a FREE account and try them yourself!
Sources:
⚠️ RISK WARNING & AI DISCLOSURE
- This information is generated by Artificial Intelligence (AI) and complex algorithms. While advanced, these systems can contain errors or inaccuracies and are for educational purposes only.
- Technical analysis provides no guarantees; this information is purely informative.
- All discussed scenarios are hypothetical and do not constitute predictions or expectations.
- Past performance is not an indicator of future results.
- This is not financial advice and is not intended as a call-to-action for the reader.
- No implicit direction is claimed, and no specific behavior of market participants is suggested.