Telegram Widgets Flaw: Is Telegram Safe and How to Update

What is the Telegram widgets flaw?

The Telegram widgets flaw is a set of bugs in the engine that runs Telegram's new interactive message widgets, which researchers say allowed code to run on a user's device in older app builds ^[7]. Telegram introduced widgets in Bot API 10.4 on 9 November 2026 ^[1]. Pavel Durov, Telegram's founder, announced them the next day with the line "Any Telegram message can now become an app", describing widgets as interactive, natively rendered and smaller than 4 KB ^[2].

A widget is a small program sent inside a message. To run it, the Telegram apps include a compact JavaScript engine called QuickJS ^[7][8]. Any engine that runs code from outside is a target, because a bug in it can let a crafted program break out of the box it is meant to stay in.

On 11 November the security researchers V12 posted "Any telegram message can now become RCE", meaning remote code execution, and posted a cryptographic hash and a demonstration video ^[3]. A public write-up by researcher davtur19 described a parser bug in QuickJS-ng plus several more engine bugs on Android, and lists the main one with CVSS severity scores of 9.6 and 8.8 ^[7].

Below: the risk for ordinary users and what to do. No details of how to reproduce the attack are given.

Which Telegram apps and versions were affected?

According to the researcher's write-up, the affected builds were Telegram for Android builds 72889, 72929, 73029 and 73039, Telegram for iOS 13.2, Telegram Desktop 7.4.0 and Telegram for macOS 13.1, all now superseded ^[7]. The same write-up says every issue it lists is fixed in current builds, with the fixes in Telegram's own fork of QuickJS ^[7].

Telegram's widget-sandbox project, which holds the shared widget code, records its fixes publicly. Version 0.6.4, dated 10 November, lists five use-after-free and out-of-bounds fixes; it says one of the bugs it closes was reported against Telegram Android 13.2.1 as native code execution from a widget's script ^[8]. Version 0.6.5, dated 12 November, adds a limit of 1,024 levels on how deeply a widget's elements can nest ^[8].

For Telegram Desktop, the public release list shows a run of quick updates: 7.4.0 on 5 November, which added HTML widgets in bots, then 7.4.1, 7.4.2, 7.4.3 on 12 November and 7.4.4 on 13 November ^[9]. The table below sums up what is public.

Is Telegram safe to use right now?

The bugs the researchers published are fixed in current builds, but a new claim about the desktop app on 13 November is unresolved, so the sensible course is to keep every Telegram app updated and avoid unknown bots ^[5][7]. The bugs that researchers published are fixed in current builds, Telegram says the Android fix reached all users on 11 November, and no attacks on ordinary users have been reported publicly as of 13 November 2026 ^[4][7][10].

The caveat comes from the researchers themselves. In its 13 November post, V12 argued that "allowing (unsandboxed!) QuickJS in messages massively opens up the attack surface", meaning new bugs may be found even after the first ones are fixed ^[5]. CyberSIXT quoted researcher Joel Eriksson noting that the engine runs inside the Telegram process itself ^[10]. Telegram has not published a security advisory or CVE identifiers for the fixes ^[10]. The Russian outlet Kod.ru reported on 13 November, citing Gram News, that Telegram had switched off the sending of HTML widgets for all bots on the server side while widgets already delivered keep working; Telegram's own confirmation was not found ^[11].

For people at higher risk, such as journalists, activists and anyone whose phone could be targeted, the bar is higher. Keep Telegram updated daily this week, avoid unknown bots completely, and consider moving sensitive conversations to an app with end-to-end encryption on by default. The Pouyam guide Telegram or WhatsApp for Private Chats in Iran? Encryption and Unofficial App Risks compares the options.

What do Durov and the researchers disagree about?

The core dispute is whether a user could be attacked just by receiving a message, and whether the Windows app was still exposed after the first fixes; both points are disputed as of 13 November 2026 ^[5][6][7].

Durov's position, posted on 13 November: "The issue doesn't exist. No one could be hacked just by receiving a message. You had to start a 3rd party service first. Even that is fully patched server-side." ^[6] He also invited people to try to hack his own account ^[6].

The researchers' position: the davtur19 write-up says widgets run when the message is laid out on screen, with no tap needed ^[7]. V12 posted a second demonstration on 13 November that it says works on the "patched" Windows client ^[5].

The two statements can partly fit together. Telegram's Bot API documentation says that in production, widgets can only be sent to private chats ^[1], and CyberSIXT notes that bots cannot message users who have not started them ^[10]. Press reports on V12's demonstrations say the user first opened the bot's chat and pressed Start ^[11][12]. So the route shown was a bot that the user had started; the write-up says that once a widget arrives it runs without a further tap ^[7]. Whether that counts as "no-click" is the argument. The 13 November claim about the desktop client has not been independently verified, so it is reported here as a claim.

How do I update Telegram on Android, iPhone and PC?

Install the latest Telegram version from the official store or telegram.org on every device you use, then restart the app ^[7][9]. Each app updates on its own, so a fixed phone does not protect an old desktop app on the same account.

1. Android: open Google Play, search for Telegram and tap Update. If you installed from Telegram's own website, download the newest version from the same official site.
2. iPhone and iPad: open the App Store, go to your account page and update Telegram, or turn on automatic app updates.
3. Windows and Linux (Telegram Desktop): use the app's update check in Settings, or download the newest build from telegram.org; as of 13 November 2026 the newest public release is 7.4.4 ^[9].
4. macOS: update Telegram from the Mac App Store or from within the app, depending on where you installed it.
5. Telegram Web: reload the page so the browser loads the latest code.

After updating, open Settings, then Devices (or Active Sessions), and end any session you do not recognise. That step does not fix the widget bugs, but it closes doors if anything else has gone wrong.

How can I stay safe from malicious Telegram bots and widgets?

Do not start bots you do not know, and delete and block any bot that sends unexpected interactive content ^[10]. In production, widgets can only be sent to private chats ^[1], and press reports on the V12 demonstration say the user first started the bot ^[11][12], so a cautious start-button habit removes the route that was shown.

• Start only bots you trust: ones run by a service you already use, linked from its official website.
• Be wary of links promising free Telegram Premium, crypto airdrops, gifts or "verification". These are the usual lures for getting someone to open a bot.
• Do not install modified or unofficial Telegram apps. They may lag behind official security fixes.
• Turn on two-step verification with a strong password, so a stolen session or SMS code alone is not enough to take your account.
• Keep your phone's own operating system updated; it limits what any app bug can reach.

If you think your account has already been taken over, follow the steps in the Pouyam guide WhatsApp or Telegram Account Hacked? How to Recover It and Lock It Down.

Will there be more Telegram widget bugs?

More bugs are likely to be reported, because the widget engine is new, public and now under close attention from researchers ^[5][8]. Telegram's widget-sandbox project published four releases between 9 and 12 November, two of them labelled security or hardening fixes to the QuickJS engine ^[8], and the desktop app shipped four updates in eight days ^[9].

Signs to watch for: a formal Telegram security advisory, CVE identifiers for the QuickJS bugs, an independent confirmation or rebuttal of the 13 November Windows claim, and any report of widgets being abused against real users ^[5][10]. Until then, the safest approach is to treat widgets from unknown bots as untrusted code, which is what they are.