Telegram Message Apps Lack Sandbox Protection, Cosine Warns

Telegram’s Nov. 10 message-app announcement lets any message function as an app smaller than 4 KB, but the new system lacks meaningful sandbox protection, according to SlowMist founder Cosine, who urged users to delay updating.

Telegram founder Pavel Durov announced Nov. 10 that any Telegram message could function as an app, with downloads under 4 kilobytes and support for interactive rendering and payments. Bot API 10.4 enables native HTML widgets inside message bubbles.

What did Telegram announce?

The design puts app distribution inside the messaging client. Its announced components include:

• Apps with downloads under 4 kilobytes
• Interactive rendering within messages
• Payment support
• Native HTML widgets through Bot API 10.4

For developers, the structure caps the distribution payload at under 4 KB and makes messages a delivery layer for interactive software. For users and businesses, it brings that software closer to account, communications and payment workflows. The warnings challenge whether Telegram sufficiently contains untrusted widget code before it runs inside the client.

Why did Cosine warn?

Cosine said Telegram’s use of QuickJS, a JavaScript engine, could create a route for malicious code execution inside the messaging client. He tied that risk to the rapid advancement of vulnerability discovery and exploitation using AI, arguing that unnecessary features become more dangerous as attackers shorten the path from flaw to exploitation.

His recommendation was to delay updating, which makes the warning more than a general caution about a new release. It asks users to pause a normal software update while the concern remains unresolved. No deadline accompanied that recommendation, and the disclosures did not report a completed exploit, affected-user count or financial loss.

What did researchers find?

Security researcher owarida described the widgets’ sandbox as a QuickJS interpreter “running inside the Telegram process on a thread.” The interpreter lacked isolation measures such as fork, isolatedProcess or seccomp, according to owarida. In practical terms, the widget runtime shares the host process rather than receiving a separate security boundary.

According to owarida, standard JavaScript could trigger a use-after-free flaw in QuickJS. The main branch contained the only available fix, leaving the timing of any distribution into Telegram’s client unspecified.

Another researcher, V12, separately warned that “any Telegram message could become a remote code execution path.” That formulation shifts the issue from a flaw in one widget to the possibility that ordinary message delivery could serve as the trigger. It remains a warning about a possible path; the published warnings do not identify a malicious message, an attack campaign or an exploit used in the wild.

What changes for users and developers?

The absence of fork, isolatedProcess or seccomp matters because Telegram’s payment and interactive-rendering ambitions put executable widget code in a sensitive client environment. A widget error that remains confined to JavaScript is an application defect; a memory-safety flaw in a runtime sharing the host process could cross that boundary. The researchers’ concern therefore turns a lightweight delivery feature into a client-security issue.

Cosine’s AI argument raises the bar for feature restraint. If discovery and exploitation cycles shorten, adding code-execution capabilities to a messaging client carries more risk even when the payload itself is tiny. The 4 KB limit reduces distribution weight, but it does not answer whether code can be contained once it runs.

What happens next?

The immediate checkpoint is the next client build: Telegram needs to isolate the QuickJS runtime, incorporate the available main-branch fix or otherwise show that a crafted widget cannot escape into the host process. No release deadline accompanied the warnings, so the next update will provide the first concrete test of whether Telegram changes the feature’s security model.