SlowMist Founder Warns Telegram Message Apps Lack Sandbox Protection

SlowMist founder Cosine urged Telegram users to delay updating after warning that the app’s new message-based apps lack sandbox protection, raising concerns about code execution inside the messaging client.

Cosine said Telegram’s use of QuickJS, a JavaScript engine, could create a route for malicious code execution. He argued that vulnerability discovery and exploitation using AI have advanced sharply, making unnecessary features riskier.

Telegram founder Pavel Durov announced Nov. 10 that any Telegram message could function as an app, with downloads under 4 kilobytes and support for interactive rendering and payments. Bot API 10.4 enables native HTML widgets inside message bubbles.

Security researcher owarida described the widgets’ sandbox as a QuickJS interpreter running inside the Telegram process on a thread, without isolation measures such as fork, isolatedProcess or seccomp. The researcher claimed standard JavaScript could trigger a use-after-free flaw in QuickJS and said a fix was available only in the main branch. Researcher V12 separately warned that any Telegram message could become a remote code execution path.