Security team warns: Telegram's new in-message JS runs unsandboxed, don't upgrade
OwariDa · x · 2026-11-12
Security team nebu security warns that Telegram's latest update lets any message become an app running JavaScript natively (under 4KB, instant download, per Durov), but the QuickJS runtime was never properly sandboxed. A bug in QuickJS or the native rendering path would allow native code execution inside the Telegram app. They call shipping unisolated JS in native messages a major design mistake and advise staying on the current version until further notice.
More from Safety
- roon: OpenAI team 'utterly locked in' on control and alignment post-incident — paulnovosad · 2026-11-12
- Verona Declaration sets principles for generative AI use in computing research — luislamb · 2026-11-12
- Evitable, founded by AI-risk researcher David Krueger, hires a communications associate at $80K-$98K — DavidSKrueger · 2026-11-12
- Studies: Data Centers Cause Just 4% of US Home Rate Hikes as Senator Backs Moratorium — Eliv_nurotic · 2026-11-12
- DC residents urged to call councilmembers before AV legalization window closes for 4 years — AndyMasley · 2026-11-12
- Beff: coordinated takedown is labs preparing regulatory capture — fight for compute next year — beffjezos · 2026-11-12