Telegram Patched an RCE Flaw in Hours; Durov Now Dares Hackers to Break In

Telegram patched a remote code execution vulnerability on November 11, 2026, within hours of a proof-of-concept demonstration by security firm V12 — and founder Pavel Durov has since publicly challenged hackers to exploit the flaw themselves.

The vulnerability affected HTML widgets that Telegram rolled out to its Android and Windows apps around November 9–10. Those widgets power interactive features inside the messaging app, including payments. On November 11, V12 researchers demonstrated a proof-of-concept showing the widgets could enable remote code execution on a user's device.

Telegram pushed a server-side patch to all users the same day. Because the fix lived on Telegram's own infrastructure, users needed no app update to receive it.

What is Durov actually disputing?

On November 13, Durov intervened personally. He rejected claims that the flaw let attackers compromise a target simply by sending them a message. According to Durov, exploitation required an active third-party service to be initiated first — a precondition that sharply narrows the population of users who could realistically be hit.

Durov argued the vulnerability did not exist in the form researchers had described. Telegram has stated that no confirmed exploitations or data theft have been linked to the reported flaw, and no successful in-the-wild attacks tied to the issue have surfaced.

The dispute turns on severity rather than existence. V12's proof-of-concept framed the issue as a remote code execution risk, meaning an attacker could run arbitrary code on a victim's device. Durov's framing — that a third-party service had to be active before any exploitation path opened — implies a far more constrained attack surface.

Why the crypto angle matters

The incident landed at an awkward moment for Telegram's payments ambitions. The company's expanding feature set now includes support for payments through newly integrated crypto wallets, and more than 1 million new integrated wallets appeared within 48 hours of the security episode.

That scale changes the stakes of any widget-level flaw. Widgets sit directly in the payment flow, so a genuine remote code execution vector in that layer would expose wallet interactions, not just chat metadata. A same-day patch therefore covered both the messaging risk and the monetary one.

What happens next?

Durov's public dare functions as an unsolicited stress test of Telegram's security posture. If his account stays untouched, the episode quietly bolsters the company's account of the flaw's limited reach. If someone succeeds, Telegram faces a far louder problem than a disputed bug report.

For now, the immediate damage looks contained: the flaw was demonstrated, patched the same day, and no attacks have been confirmed. The open question is whether independent researchers corroborate V12's severity assessment or Durov's narrower reading — and whether the million-plus new wallet users drawn in during those 48 hours will factor into how Telegram discloses widget flaws going forward.