Telegram Patches Critical QuickJS Sandbox Escape Vulnerability in Android Update 13.2.2
Telegram has issued an urgent update for its Android application, version 13.2.2, to close a dangerous sandbox-escape vulnerability in HTML widgets used by bots.
The flaw was introduced when Telegram opened HTML widgets to bots on November 9. A specially crafted script inside a regular message could escape the widget sandbox and execute native machine code on the device. The root cause lay in the JavaScript engine QuickJS that Telegram maintains in its own fork called QuickJS-ng.
Technical Details of the Vulnerability
The parser incorrectly accepted the await using syntax inside the header of a loop even when the surrounding function was not declared async. In such cases the engine followed the asynchronous termination path, failed to release references to local variables, and left nested functions pointing to already-freed stack memory. This class of bug is known as use-after-return.
The vulnerable code reached the main branch of QuickJS-ng on May 16 together with support for explicit resource management. Although the issue was first reported against Telegram for Android 13.2.1, the same engine fork is used across all platforms.
Patch and Disclosure
The fix was merged on November 10: the parser now correctly emits a syntax error for the invalid construct. The same day Telegram published Android build 13.2.2 containing the patch.
The vulnerability was found by developer Andreas Rösler during a comprehensive security audit of QuickJS-ng performed with Anthropic’s Claude model. The resulting report lists 27 findings; the await-using issue is ranked third and classified as high severity.
Related articles
Telegram Patches RCE Vulnerabilities in HTML Widgets After Researcher Demonstrates Calculator Exploit
Telegram introduced HTML widgets for bots in early November, allowing JavaScript execution inside messages via the QuickJS engine. Security researcher V12 quickly demonstrated remote code execution by launching the system calculator on Android. Pavel Durov responded that no vulnerability existed because the user had to first start the bot, yet server-side fixes were deployed anyway. Multiple use-after-free and use-after-return bugs were identified in QuickJS and QuickJS-ng, some discovered with AI assistance from Claude Fable 5.1 and Mythos 5.2. Telegram isolated the widget engine into a separate process on Android, added syscall filtering, and limited nested graphical effects to prevent crashes. Desktop clients received the fixes across versions 7.4.2 and 7.4.3, while widgets were temporarily restricted server-side. Users are advised to update to Android 13.2.2 or Desktop 7.4.3 and avoid unknown bots.
Node.js Patches 16 Vulnerabilities Exposing TLS Private Keys and Cross-Connection Data
The Node.js project has released fixes addressing 16 vulnerabilities, seven of which are rated high severity. The most critical issue, CVE-2026-123864, allows an unauthenticated client to read memory from other HTTPS connections, potentially exposing TLS private keys and requests belonging to other users. Three supported release lines were affected, and exploitation requires a specific application code pattern involving res.flushHeaders() and res.end() calls before the request body is fully received. Additional high-severity flaws include CVE-2026-123863, which crashes HTTP/2 servers, CVE-2026-123866 that leaks server memory chunks to clients, and CVE-2026-123865 that causes permanent memory and file descriptor leaks in HTTP/2 servers. Several other CVEs affect TLS renegotiation, SNI callbacks, and file streaming functions. The project states that end-of-life branches including 20.x and 25.x remain vulnerable with no patches available.
Microsoft Confirms November Windows Updates Break Activation, Licensing and Printing Functions
Microsoft has acknowledged that its November 2024 cumulative updates are causing failures in Windows activation and licensing operations on multiple supported platforms. The Software Licensing Management Tool (SLMGR) returns error 0x80041008 when administrators run commands such as slmgr.vbs /skms-domain or slmgr.vbs /ipk, preventing product activation, KMS server configuration, and product key changes. The issue affects Windows 11 23H2, Windows 10 22H2, Windows 10 21H2, Windows Server 2025, Windows Server 2022, and Windows Server 2019. A separate regression introduced by the same updates prevents printing of documents that contain images with zero height or width, a technique used for watermarks in Microsoft Word and other applications. Microsoft stated that a fix will be released in the coming days and advised enterprise customers needing an immediate workaround to contact business support.
Fortinet Discloses Multiple Critical Vulnerabilities in FortiMail, All Addressed in October Update
Fortinet has published 24 security advisories detailing 27 vulnerabilities affecting its FortiMail email security product. Eight of the flaws received the highest severity rating of Critical, with three carrying a CVSSv3.1 base score of 9.8. The affected issues include path traversal CVE-2026-126147, command injection CVE-2026-126148, and SQL injection CVE-2026-126263, each capable of enabling arbitrary code execution. An additional unauthenticated SQL injection vulnerability tracked as CVE-2026-126164 scored 9.4, while four more flaws were rated 9.1. All issues were resolved in the October security update released by the vendor prior to the November 10 disclosure. No exploitation of the vulnerabilities has been observed in the wild at the time of advisory publication.