Telegram Patches RCE Vulnerabilities in HTML Widgets After Researcher Demonstrates Calculator Exploit
Telegram rolled out HTML widgets for bots on 9 November, enabling interactive JavaScript content directly inside chat messages. The feature runs JavaScript through the QuickJS engine inside a sandbox that originally lacked network access and keyboard input.
Researcher Demonstration Triggers Rapid Response
Security researcher V12 published a proof-of-concept showing that a widget could launch the system calculator on Android, proving that sandbox restrictions could be bypassed. The demonstration highlighted memory-safety issues that allowed code execution outside the intended environment.
Pavel Durov posted that “the problem does not exist” because an attacker would first need the victim to start a third-party bot. He invited researchers to attempt compromising his account at t.me/monk. Despite the statement, Telegram quickly shipped server-side mitigations and multiple client patches.
Timeline of Fixes and Discoveries
- 5 November – Telegram Desktop 7.4.0 adds initial HTML widget support.
- 6 November – Widget engine v0.6.1 ships seven fixes, including one explicitly labeled “the reported RCE”.
- 9 November – Widgets become available to all bots via Bot API 10.4; an audit of QuickJS-ng reports 27 findings.
- 10 November – Engine v0.6.4 addresses five additional memory errors and a second code-execution issue found on Android 13.2.1.
- 11 November – V12 publishes the calculator video; Desktop 7.4.2 is released.
- 13 November – Desktop 7.4.3 finally includes the critical await-using patch.
Technical Root Causes
The first vulnerability involved a regular-expression replace operation that could trigger recompilation of the same regex while the engine still held references to freed bytecode, resulting in a classic use-after-free condition. The second flaw stemmed from an await using declaration placed inside a non-async function; the engine accepted the code, the function returned, yet closures continued accessing the now-reused stack frame, creating a use-after-return situation.
Both issues were found during audits that leveraged AI tools. Andreas Rösing used Claude Fable 5.1, while Connor Shi confirmed another memory bug discovered by Mythos 5.2.
Platform-Specific Hardening
On Android 13.2.2 the widget engine was moved into a dedicated isolated process without access to Telegram files or the network. Additional syscall filtering was introduced in audit mode, and the number of nested graphical effects was capped to prevent stack overflows or excessive memory consumption. Equivalent patches reached Desktop clients in versions 7.4.2 and 7.4.3, although release notes remained generic.
Widgets are currently restricted server-side, causing some bots to stop responding. No code changes are required from bot developers; the vulnerabilities resided in the client-side engine, not in the HTML itself.
Related articles
Telegram Patches Critical QuickJS Sandbox Escape Vulnerability in Android Update 13.2.2
Telegram has released version 13.2.2 for Android to address a high-severity vulnerability in its HTML widgets for bots. The flaw resided in the QuickJS JavaScript engine within Telegram's QuickJS-ng fork and allowed scripts in ordinary messages to break out of the sandbox and execute native code on the device. The root cause was improper handling of the await using construct inside non-async functions, which triggered a use-after-return condition by freeing local variable references while nested functions still accessed the stack. The vulnerable code entered the QuickJS-ng main branch on May 16 as part of explicit resource management support. Security researcher Andreas Rösler discovered the issue during an AI-assisted audit with Anthropic's Claude model that identified 27 findings total. The patch enforces a syntax error on the invalid construct and was merged on November 10, the same day the Android release became available. Although reported against Android 13.2.1, the bug affected every platform using the affected engine fork.
Node.js Patches 16 Vulnerabilities Exposing TLS Private Keys and Cross-Connection Data
The Node.js project has released fixes addressing 16 vulnerabilities, seven of which are rated high severity. The most critical issue, CVE-2026-123864, allows an unauthenticated client to read memory from other HTTPS connections, potentially exposing TLS private keys and requests belonging to other users. Three supported release lines were affected, and exploitation requires a specific application code pattern involving res.flushHeaders() and res.end() calls before the request body is fully received. Additional high-severity flaws include CVE-2026-123863, which crashes HTTP/2 servers, CVE-2026-123866 that leaks server memory chunks to clients, and CVE-2026-123865 that causes permanent memory and file descriptor leaks in HTTP/2 servers. Several other CVEs affect TLS renegotiation, SNI callbacks, and file streaming functions. The project states that end-of-life branches including 20.x and 25.x remain vulnerable with no patches available.
Microsoft Confirms November Windows Updates Break Activation, Licensing and Printing Functions
Microsoft has acknowledged that its November 2024 cumulative updates are causing failures in Windows activation and licensing operations on multiple supported platforms. The Software Licensing Management Tool (SLMGR) returns error 0x80041008 when administrators run commands such as slmgr.vbs /skms-domain or slmgr.vbs /ipk, preventing product activation, KMS server configuration, and product key changes. The issue affects Windows 11 23H2, Windows 10 22H2, Windows 10 21H2, Windows Server 2025, Windows Server 2022, and Windows Server 2019. A separate regression introduced by the same updates prevents printing of documents that contain images with zero height or width, a technique used for watermarks in Microsoft Word and other applications. Microsoft stated that a fix will be released in the coming days and advised enterprise customers needing an immediate workaround to contact business support.
Fortinet Discloses Multiple Critical Vulnerabilities in FortiMail, All Addressed in October Update
Fortinet has published 24 security advisories detailing 27 vulnerabilities affecting its FortiMail email security product. Eight of the flaws received the highest severity rating of Critical, with three carrying a CVSSv3.1 base score of 9.8. The affected issues include path traversal CVE-2026-126147, command injection CVE-2026-126148, and SQL injection CVE-2026-126263, each capable of enabling arbitrary code execution. An additional unauthenticated SQL injection vulnerability tracked as CVE-2026-126164 scored 9.4, while four more flaws were rated 9.1. All issues were resolved in the October security update released by the vendor prior to the November 10 disclosure. No exploitation of the vulnerabilities has been observed in the wild at the time of advisory publication.