Telegram Patches Widget Vulnerability, Founder Challenges Hackers Amidst Crypto Wallet Expansion
Telegram recently rolled out HTML widgets for its Android and Windows applications between November 9 and 10, 2026, designed to power interactive features, including payments. Shortly after, on November 11, security firm V12 demonstrated a proof-of-concept for a remote code execution (RCE) vulnerability linked to these new widgets. Telegram responded swiftly, deploying a server-side patch to all users within hours of the demonstration on the same day. This server-side fix meant users did not need to manually update their applications. Telegram founder and CEO Pavel Durov personally addressed the issue on November 13, disputing claims that the flaw allowed attackers to compromise accounts merely by sending a message. Durov asserted that exploitation would have required an active third-party service to be initiated first, thereby narrowing the scope of potential impact. Telegram has stated that there have been no confirmed exploitations or data theft related to the reported flaw, and no successful in-the-wil...