CryptoSlate
Telegram has blocked ordinary bots from sending interactive HTML widgets, including in private chats, after researchers raised concerns that widget code could execute without a tap on some older clients. Bot API contributor levlam confirmed the restriction on November 13, two days before a separate update, while Telegram maintained that its security remediation had blocked the relevant attack path.
The researchers' archive says the published vulnerabilities affected listed older builds, including Android, iOS 13.2, Desktop 7.4.0 and macOS 13.1, and that current Telegram builds contain fixes. The scope differs by client: some findings involved app-level code execution, while others were contained in an isolated widget process. Telegram founder Pavel Durov said receiving a message could not compromise a device unless a user first started a third-party service and then interacted with the delivered widget.
Why it matters
HTML widgets differ from Telegram Mini Apps because they run inside the message itself. Telegram describes the widget environment as isolated, with code executing on the user's device without direct internet access and bot requests routed through Telegram. The restriction affects general bots, not ordinary bot messages or all bot services, but Telegram has not explained when previously delivered widgets will stop rendering or when broader access may return.
The design includes direct wallet connections. Telegram's documentation covers widget queries involving a user's TON wallet card, wallet-signed data and notifications about wallet transactions. These capabilities make the feature relevant to crypto users, but the reported vulnerabilities do not establish unauthorized signing, asset theft or widespread malicious exploitation.
Market impact
For crypto users, the immediate risk is concentrated in older or vulnerable client builds and in the delivery of widgets through bots. Current builds reportedly include fixes, but the research archive does not identify one definitive safe version for every platform.
Frequently asked questions
-
What Telegram feature has been restricted?
Telegram blocked ordinary bots from sending HTML widgets, including in private chats. It did not announce a shutdown of ordinary bot messages or all bot services.
-
Can a Telegram widget execute without a tap?
Researchers said widget code could run during chat layout without a tap on affected older clients. They also said delivery required a bot permitted to send widgets, and the finding depended on the client build.
-
Are current Telegram builds affected by the published flaws?
The researchers said their published vulnerabilities were fixed in current Telegram builds. Their archive does not establish one definitive minimum safe version across every client.
-
Was unauthorized crypto signing or theft demonstrated?
No. The widget design includes TON wallet queries and wallet-signed data, but the reported findings do not establish unauthorized signing, asset theft or widespread malicious exploitation.
-
When will Telegram restore general widget access?
No restoration timetable was announced. The confirmation also leaves unresolved how previously delivered widgets will render across clients.
WuBlockchain
CoinDesk
TheBlock