Telegram widget flaw exposes Android users to remote code execution, Bybit warns

• Telegram patched a remote code execution flaw in Android on November 11, one day after security firm V12 demonstrated a bot opening the Calculator app without user consent.
• Telegram’s new widget feature, released November 9, supports TON blockchain payments through Gram Wallet, with over 1 million wallets activated in 48 hours.
• The vulnerability poses direct risk to crypto users because widgets can theoretically access session data and login tokens, circumventing two-factor authentication on already-open accounts.

• November 9 Date Telegram released Bot API 10.4 with widget functionality
• 1 million TON wallets activated within 48 hours of widget launch
• 32KB Maximum uncompressed code size per widget before compression

Telegram released a new widget feature on November 9 as part of Bot API 10.4, allowing bots to embed interactive elements, polls, games, and TON blockchain payments, directly into chat messages. According to the technical breakdown, each widget lets developers send HTML code up to 32 kilobytes uncompressed, with payments processed through Gram Wallet, Telegram’s non-custodial wallet for the TON blockchain’s native currency. Users must explicitly approve each transaction on a confirmation screen showing the bot, amount, and destination. Two days after launch, security firm V12 posted video evidence that a malicious bot message could trigger remote code execution on Android devices, opening the Calculator app without user interaction. Telegram responded on November 11 by stating the flaw was patched the previous day and deployed to all users that morning.

Telegram patches Android flaw 24 hours after V12 demonstration

The vulnerability stemmed from how Telegram’s Android client handled widget HTML rendering. V12’s proof-of-concept showed that a compromised or attacker-controlled bot could craft a widget message that executed system commands on the recipient’s device, a capability known as remote code execution. V12 did not disclose the attack methodology, and no independent researcher has publicly confirmed the flaw or provided reproduction steps. Kod.ru, a Russian tech outlet, found no evidence of real-world exploitation in the wild.

This marks Telegram’s second Android code-execution vulnerability disclosed in a month, after a separate voice-call bug reported by security firm NebuSec. The rapid succession underscores systemic issues in Telegram’s Android codebase security review processes.

Widget payments on TON create new attack surface for crypto account compromise

The security risk cuts deeper for cryptocurrency users because widgets operate within Telegram’s access context. Bybit warned users on Friday that a compromised device running Telegram alongside exchange or wallet apps could expose both platforms to lateral compromise. The core threat is not the widget itself, but what an attacker with code execution can reach: session tokens, login cookies, and wallet state files stored in Telegram’s sandbox or shared across the phone’s application memory.

Two-factor authentication does not protect sessions already logged in and active on the device. An attacker executing code with Telegram’s runtime permissions could theoretically read wallet private keys or signing data if they are cached in application memory, particularly for self-custody solutions that store keys locally. Telegram’s widget feature supports payments through Gram Wallet, where over 1 million wallets went live within 48 hours, meaning a large population of TON users suddenly had crypto exposure tied to a messaging platform with an active code-execution vulnerability.

The specific risk is compounded because widgets are embedded in messages that users expect to be passive text or media, not executable code.

Widgets moving to groups with no defined rollout timeline

Telegram has not stated whether iPhone or desktop clients were affected by the flaw, leaving users on those platforms uncertain of their exposure. More critically, the company plans to expand widgets to group chats and enable message forwarding of widgets, but has not announced a production launch date for either capability.

Wider distribution to group conversations would multiply the attack surface: group bots reach dozens or hundreds of members with a single malicious message, versus current private one-on-one bot chats.

The gap between Telegram’s patch announcement and public understanding of the flaw’s root cause remains unusually wide, leaving security researchers unable to validate whether related vulnerabilities exist in other code paths.

The CCS read. The widget flaw itself has been patched, but the institutional question is whether Bybit and other platforms will restrict Telegram as an authorized communication channel for critical alerts, or require users to disable widgets entirely. A 24-hour patch cycle is fast, but the existence of two Android RCE flaws in one month suggests Telegram’s security posture remains below the bar crypto institutions expect for messaging that coordinates account access.

Watch for Bybit and other major exchanges to publish updated security guidelines specifying whether Telegram remains approved for two-factor authentication codes or account notifications. Telegram has not confirmed whether widgets will be allowed in groups or whether forwarding will be enabled; if either proceeds without hardened sandboxing, the risk to users running exchange and wallet apps on the same device will reset.

Original reporting: beincrypto.com