Telegram Update: How to Install the Widgets Security Fix

Which Telegram version fixes the widgets flaw?

The widgets fix is in Telegram for Android 13.2.2 or newer and Telegram Desktop 7.4.3 or newer; for iPhone, iPad and Mac, install the newest version from the App Store or Mac App Store, because no exact fixed build has been published ^[1][2]. These numbers come from Telegram's open-source code and release lists, read by independent reporters, not from a Telegram advisory: Telegram has not published one ^[2][7].

The flaw sat in QuickJS, the small JavaScript engine that runs the interactive widgets Telegram added for bots in Bot API 10.4 on 9 November 2026 ^[9]. On 11 November the security company V12 posted a video in which a widget message started the calculator on an Android phone, the usual sign that outside code is running on a device ^[1]. Gram News matched that report to a QuickJS fix dated 10 November, 21 minutes before Pavel Durov's announcement opening widgets to all bots, and says the fix shipped in Telegram for Android 13.2.2 (build 7303) ^[1].

Telegram Desktop took two tries. Neurocrat, which compared the builds, reports that version 7.4.2 of 11 November carried five other memory fixes but not the key patch, which only arrived in 7.4.3 ^[2]. The public release list shows 7.4.3 on 12 November and 7.4.4 on 13 November, both described only as "Bug fixes and other minor improvements" ^[3].

For Apple devices the picture is less precise. The researchers' archive lists Telegram for iOS 13.2 and Telegram for macOS 13.1 among the affected builds and says the published bugs are fixed in current builds ^[8]. Neurocrat could not find build numbers with the patches for iPhone or Mac ^[2]. The practical rule is simple: whatever device you use, the newest official version is the one to have.

This guide is the step-by-step follow-up to the Pouyam guide Telegram Widgets Flaw: Is Telegram Safe and How to Update, which explains the flaw itself and the dispute about how dangerous it was.

How do I check which Telegram version I have?

On Android the version number is shown at the bottom of Telegram's Settings screen; on other devices it is in the app's settings or in the phone's app information ^[1]. Compare it with the table below. If your number is lower than the one listed, update before you open any chat with a bot.

On Telegram Desktop for Windows and Linux, open Settings, then Advanced: the section on version and updates shows the installed version and lets you check for a new one. On an iPhone or iPad, the system shows an app's version under Settings, General, iPhone Storage (or iPad Storage), then Telegram. On a Mac, open the app menu and choose About Telegram.

Two details often confuse people. First, Android build numbers and version numbers are different things: Gram News gives the fixed release as 13.2.2 with the build number 7303 in brackets ^[1]. The researchers' archive refers to older Android builds by longer build codes such as 72889, 72929, 73029 and 73039 ^[8]. Second, there are two Telegram apps for the Mac: Telegram for macOS from the Mac App Store, which the researchers list as version 13.1 when affected, and Telegram Desktop, the same app as on Windows, which follows the 7.4.x numbering ^[3][8].

A version check is worth doing even if your phone updates apps automatically. Automatic updates can be delayed for days by low storage, battery saving, a metered connection or a store account that is signed out.

How do I update Telegram on Android?

Update Telegram from Google Play, or from Telegram's own website if that is where you installed it, and make sure the version shown afterwards is 13.2.2 or higher ^[1]. Telegram said on 11 November 2026 that the Android fix "was deployed to all users", so the update should already be offered in the store ^[10].

1. Open Google Play, tap your profile picture, then Manage apps and device, and look for Telegram under available updates. Tap Update.
2. If you installed Telegram from the APK on telegram.org, download the newest APK from the same official site and install it over the old one; your chats stay in place.
3. Open Telegram, go to Settings and scroll to the bottom to read the version number ^[1].
4. Restart the app once, so the new widget engine is the one in use.

Gram News points out that the five further engine fixes in widget-sandbox 0.6.4, published later on 10 November, do not appear to be pinned in 13.2.2 itself ^[1][5]. That is a reason to keep updating past the minimum: each newer build can carry more of the engine fixes listed in Telegram's public change log ^[5].

Avoid APK download sites, modified clients and unofficial "plus" or "gold" versions. They are not built from Telegram's current code on Telegram's schedule, so a fix that reaches the official app may arrive late or never. The Pouyam guide Telegram or WhatsApp for Private Chats in Iran? Encryption and Unofficial App Risks explains why unofficial versions are a security risk in their own right.

How do I update Telegram Desktop on Windows and Linux?

Open Settings, then Advanced, and use the version and updates section to check for an update, or download the newest build from telegram.org; you need 7.4.3 or later, and 7.4.4 is the newest release as of 15 November 2026 ^[2][3]. The desktop app was among the clients the researchers listed as affected, in version 7.4.0 ^[8].

1. In Telegram Desktop, open the menu, then Settings, then Advanced.
2. Turn on automatic updates if the option is off, then choose the check for updates option. When the download finishes, restart Telegram when asked.
3. Check the version number again in the same section. It should read 7.4.3 or higher ^[3].
4. If you installed Telegram through the Microsoft Store, a Linux package manager, Flatpak or Snap, update it through that same channel; those builds can arrive a little later than the release on GitHub ^[3].

Windows users should take one extra step this week. On 13 November the researchers at V12 claimed a further code-execution route on what they called the patched Windows client, a claim made in a single post, with no independent confirmation found in the sources checked ^[11]. Telegram Desktop 7.4.4 followed later on 13 November, with no detailed release notes ^[3]. Staying on the newest build is the only protection an ordinary user has while that question is open.

If you use Telegram on a work computer that you cannot update yourself, ask your IT department to push 7.4.4 or later, and until then avoid opening chats with bots on that machine.

How do I update Telegram on iPhone, iPad and Mac?

Install the newest Telegram from the App Store or Mac App Store; researchers say the bugs they found in Telegram for iOS 13.2 and Telegram for macOS 13.1 are fixed in current builds, though no exact fixed build number is public ^[2][8]. Neither Telegram nor the independent reports named a minimum safe version for Apple devices, and CryptoSlate notes that the research archive does not establish one for every client ^[2][4].

1. iPhone and iPad: open the App Store, tap your account picture at the top, scroll to the list of updates and tap Update next to Telegram. To avoid this in future, turn on automatic app updates in the App Store settings.
2. Mac, Telegram for macOS: open the Mac App Store, choose Updates and update Telegram.
3. Mac, Telegram Desktop: this is the same app as on Windows; update it from Settings, Advanced, and check that it shows 7.4.3 or later ^[3].
4. After updating, close the app fully and open it again.

If the App Store says Telegram is up to date, you already have the newest public build. There is nothing more an ordinary user can install, and the remaining protection is behaviour: do not start bots you do not know ^[6].

People who need stronger protection, such as journalists and activists, should also keep the iPhone's own iOS version current. An operating-system update limits what any app bug can reach, whichever messaging app it is in.

What changed in Telegram for Android 13.2.2?

Besides the engine fix, Telegram for Android 13.2.2 moves all widget code into a separate, locked-down process, so a future bug of the same kind would land somewhere with no access to your account, chats or keys ^[1]. Gram News reports that the release commit touches 96 files and about 6,800 lines, most of it for this new boundary ^[1].

According to the documentation in the client's code, as summarised by Gram News, the new process called :widgets runs the widget's JavaScript, its validator and its renderer ^[1]. It has no Android permissions, no network and no access to the app's files ^[1]. The main Telegram process no longer loads the engine library at all, and everything the widget process sends back is treated as untrusted and checked again, for example allowing one link per real tap ^[1].

A system-call filter called seccomp sits on top. For now it runs mostly in logging mode, recording forbidden calls rather than blocking them, but launching programs and creating new processes are already refused ^[1]. One process serves all widgets rather than one per bot; Gram News says a separate process for each bot was dropped because each would use about 25 MB of memory ^[1].

This matters for how much the version number protects you. Before the change, researcher Joel Eriksson noted that the engine ran inside the Telegram process itself, so an engine exploit got the app's own privileges ^[7]. The researchers' archive reports app-level code execution on some older Android builds, but results contained in an isolated widget process on later builds such as 72979 and 72989 ^[4]. In short, newer builds both remove the published bugs and limit the damage any new one could do.

Can bots still send widgets after the fix?

For now, no: on 13 November 2026 a contributor to Telegram's Bot API repository confirmed that general bots are not allowed to use widgets, even in private chats ^[4]. Developers who had been sending widgets began receiving the error INPUT_MEDIA_WIDGET_NOT_ALLOWED, CryptoSlate reported ^[4].

Pavel Durov, Telegram's founder, said on 13 November that "No one could be hacked just by receiving a message", that a user "had to actively start a third-party service first", and that "Even that is fully patched server-side" ^[6]. The server-side restriction and his statement point the same way: according to Durov, the route needed a third-party service that the user had started first ^[4][6].

That does not make the app update optional. CryptoSlate notes that the restriction does not say how widgets already delivered to chats are shown, why access was narrowed or when it might return ^[4]. When widgets are opened to bots again, only an updated app will carry the fixed engine. Widget code can also do more than show content: Telegram's documented design lets widgets query a user's TON wallet card or ask for wallet-signed data, which is one more reason to keep the client current ^[4].

The shared widget code keeps changing as well. Telegram's widget-sandbox project published version 0.6.4 on 10 November with five memory-safety fixes and version 0.6.5 on 12 November, which caps how deeply a widget's elements can nest at 1,024 levels ^[5]. Each client picks up those changes only in a new app release ^[5].

What if I cannot update Telegram right away?

If you cannot install the fixed version yet, do not open chats with bots you do not know, and do not start any new bot until you have updated ^[1][6]. Gram News advises avoiding chats where unfamiliar bots send widgets until the app is updated, because a widget's code runs when its bubble appears on screen ^[1].

• Check storage first: a full phone is the most common reason an update silently fails. Free some space and try again.
• If Google Play is unavailable on your phone or in your country, use the official APK from telegram.org rather than a mirror site.
• On a shared or work computer that you cannot update, use Telegram on an updated phone instead and log out of the old desktop session.
• Open Settings, then Devices, and end any session you do not recognise. This does not fix the engine, but it limits the harm if an account was already exposed in another way.
• Turn on two-step verification with a strong password, so a stolen login code alone is not enough to take over the account.

As of 15 November 2026, CryptoSlate says the researchers' demonstrations do not establish stolen assets or widespread malicious exploitation, and the researchers say their published bugs affected older builds that are now fixed in current builds ^[4][8]. That is reassuring but not a guarantee, since Telegram has not said whether the flaw was used before the fix ^[7].

If you think your account has been taken over, follow the Pouyam guide WhatsApp or Telegram Account Hacked? How to Recover It and Lock It Down. If you have lost your cloud password while securing the account, see Forgot Your Telegram Two-Step Password? Recovery With or Without Email.