Telegram has blocked bizarre bots from sending its new interactive in-message apps, referred to as HTML widgets, even in personal chats. A November 13 reply in its Bot API repository confirmed the restriction as researchers and Telegram disputed safety flaws within the function.
Responding to a developer’s report of failed widget messages, Telegram Bot API repository contributor levlam confirmed the restriction: “Sure, presently, basic bots aren’t allowed to make use of widgets even in personal chats.” The developer reported receiving the error INPUT_MEDIA_WIDGET_NOT_ALLOWED after beforehand sending widgets efficiently.
Telegram’s Bot API changelog dates the introduction of HTML-widget messaging to Bot API 10.4 on November 9. The widget information nonetheless listed private-chat manufacturing availability on November 14, regardless of levlam’s affirmation that basic bots can not use it. The affirmation issues HTML widgets; it doesn’t announce a shutdown of bizarre bot messages or all bot companies.
Not like Mini Apps, which open an internet web page on demand, widgets run contained in the message itself. Telegram’s widget documentation describes an remoted atmosphere that runs their code on the consumer’s machine with out direct web entry. Requests to the bot cross by means of Telegram as an alternative.
The function has a direct pockets connection in its documented design. Telegram’s changelog describes widget queries involving a consumer’s TON pockets card, wallet-signed knowledge or notification of a pockets transaction. These capabilities clarify the relevance for crypto customers, however don’t themselves reveal unauthorized signing or asset theft.
Analysis findings depend upon the shopper construct
As of November 14, the tg-widget-rce researchers say of their analysis archive that its printed vulnerabilities affected listed older purchasers and are fastened in present Telegram builds. The archive contains Android builds, Telegram for iOS 13.2, Telegram Desktop 7.4.0 and Telegram for macOS 13.1, with totally different findings throughout variations. It doesn’t set up a definitive minimal secure model for each shopper.
The researchers say widget code can execute throughout chat format and not using a faucet, however supply requires a bot permitted to ship widgets and the reported vulnerabilities depend upon the shopper construct. Their technical index distinguishes app-level code execution on chosen older Android builds from outcomes contained in an remoted widget course of on others. A widget-process consequence doesn’t set up management of the entire machine.
The place the researchers’ examined consequence reached
Researchers report app-level execution on these chosen older Android builds; that isn’t a whole-device takeover.
In these archived assessments, the consequence remained in an remoted widget course of and app-level compromise was not demonstrated.
A sending restriction doesn’t set up the standing of present widgets or show each shopper safe.
No reside sending check or exploit copy. Shopper examples are archived researcher studies, not present safe-version recommendation. The restriction affirmation doesn’t specify existing-widget rendering or restoration timing.
Telegram founder Pavel Durov denied that merely receiving a message may compromise customers. He mentioned customers first needed to begin a third-party service and asserted that the problem was totally patched server-side. Beginning a service and tapping a delivered widget are separate steps. Durov’s assurance is Telegram’s acknowledged place; the researchers’ demonstrations don’t set up stolen crypto property or widespread malicious exploitation.
Levlam’s affirmation provides no restoration timetable, clarification for narrowing entry or coverage for a way beforehand delivered widgets render. His reply doesn’t set up that safety studies prompted the change.
