Telegram’s HTML widgets stop working

Telegram’s new HTML widgets stopped working in chats on Friday, Telegram Info reported. The outlet said it suspected Telegram had disabled the feature after researchers raised security concerns.

Telegram opened the feature to bot developers on November 9. Widgets let bots embed polls, games and other interactive tools directly in messages. To make those tools work, Telegram runs the widget’s code in an isolated environment designed to keep it separate from the rest of the device.

Two days after the rollout, security researchers at V12 showed an Android phone unexpectedly opening its Calculator app during a bot interaction. Calculator was the visible sign of what the researchers described as remote code execution: code from the widget could make the device do something outside the chat. The demonstration did not show any data being stolen. 

Telegram founder Pavel Durov disputed claims that simply receiving a message could compromise an Android or Windows device. “You had to actively start a third-party service first,” he wrote, adding that Telegram had already patched the issue on its servers. Whether the same flaw worked on Windows or was used to steal data or take over accounts remains unconfirmed.