Mecanismo de widgets em chats do Telegram · Public exploit code

[Single source] Telegram widget flaw enables RCE on Android

Nov 11, 2026 · 1 min read

A QuickJS-ng parser flaw in Telegram's widget engine can cause out-of-bounds memory corruption and native code execution. The researcher demonstrated RCE on Android during message rendering without requiring the user to open the widget. The item does not say whether a fix is available.

By HIFY Radar newsroom Updated 11/12/2026 06:08 AM Get this every day →← Back to the feed 2 sources

CriticalVulnerabilityPublic exploit codeFix unconfirmed

In 30 seconds

Alleged

The latest supplied post alleges that a proof of concept exists for a Telegram in-chat widget flaw capable of native code execution. A separate account reports that Telegram said the Android issue had been fixed and the fix deployed to all users, but the evidence does not identify the patched version or independently verify deployment.

What happened

Alleged

According to the two discussion posts, a malformed widget can trigger an out-of-bounds write in Telegram's QuickJS-ng based widget engine. They allege that this corruption can be used to alter an ArrayBuffer and ultimately execute native code while Telegram renders a received widget message.

Why it matters

Inferred

If the reported behavior is accurate, the danger is not limited to a widget that someone deliberately opens. One account says exploitation can begin during message rendering, which would reduce the interaction required from a targeted user and make affected clients more exposed to malicious messages.

What to do

Inferred

Android users should make sure Telegram is fully updated, because one post reports that later builds contain mitigations and attributes to Telegram a statement that the Android fix was deployed to all users. The batch provides no version number, changelog, or official advisory with which to confirm that a particular installation is protected.

Confirmed and still uncertain

Observed

The supplied posts agree on the claimed parser flaw, out-of-bounds corruption, and potential native code execution. What remains unknown from this batch includes the affected version range, patch identifier, exploit reliability, attack prerequisites, whether exploitation has occurred outside research, and whether every distribution channel received the reported Android fix.

What people are saying

Alleged

DarkWebInformer says researchers demonstrated remote code execution on affected Android and iOS builds and that later Telegram builds contain mitigations. PTD Bugs, in the newer supplied post, describes a proof of concept involving a malformed strict function with eval. These are third-party accounts, not direct statements from Telegram in the supplied material.

Evolution

Observed

The earliest supplied entries point to a research repository and describe the vulnerability, demonstrations on mobile platforms, and a reported Android fix. A later post restates the technical chain and says a proof of concept or exploit has been discovered, but adds no patch version or independent confirmation of exposure.

Reach

Observed

1 independent groups, 3 updates, and 38 engagements.

Technical detail

Alleged

The claimed chain starts with a malformed strict-mode function using eval in the QuickJS-ng parser. The posts say this produces an out-of-bounds write, corrupts an ArrayBuffer, and can be developed into native code execution inside an affected Telegram client. One account also mentions additional memory-corruption and use-after-free findings, without supplying their details in this batch.

Sources and evidence

Observed

The batch contains a GitHub repository link with no accompanying body text and two X posts summarizing the research. Consequently, the detailed vulnerability and remediation claims here come from those discussion posts. The supplied evidence includes no Telegram advisory, patch notes, CVE record, reproducible test output, or repository contents that independently confirm them.