Slow Mist's Cosine: New version of Telegram's in-message embedded applications lack sandbox protection, advises users to hold off on updating temporarily.
29 minutes ago
Slow Mist founder Cosine posted on social media that the new version of Telegram supports embedding "apps" in messages but lacks sandbox protection, and the QuickJS runtime it uses could become a vector for malicious code execution. He noted that flashy features often introduce unnecessary risks, adding that AI-powered vulnerability discovery and exploitation are far more advanced than before, advising users to hold off on updating Telegram for now. The issue ties back to a new feature unveiled by Telegram founder Pavel Durov on November 10. Durov stated that any Telegram message can function as an app, weighing less than 4KB, downloading instantly, and supporting interactive rendering, payments, and other mechanisms. Related outlet Bot News explained that Bot API 10.4 enables sending native HTML widgets in message bubbles. Security researcher V12 followed up, writing that "any Telegram message can now be turned into a remote code execution vector." Another security researcher, owarida, pointed out that Telegram’s so-called "sandbox" for these HTML widgets is actually an in-process, thread-running QuickJS (C language) interpreter, with no isolation measures like fork, isolatedProcess, or seccomp. If a QuickJS vulnerability is exploited, attackers can gain the same permissions as the Telegram client without additional bypasses. owarida added that the flaw is a use-after-free vulnerability in the interpreter, triggerable via standard JavaScript, with fixes currently only available in the main branch, noting that QuickJS has had multiple vulnerabilities in the past.
Solana Company announced third-quarter revenue of $3.4 million, and holds approximately 2.4 million SOL tokens with a fair value of around $290 million.
7 minutes ago
Nomura Holdings is exploring the sale of its crypto subsidiary Laser Digital.
7 minutes ago
Forbes: If Jensen Huang steps down, Nvidia's stock price and the artificial intelligence industry could suffer a severe blow.
7 minutes ago
Polymarket to lay off staff and terminate contracts with some contractors
7 minutes ago
The White House did not interfere with the decisions of Nvidia's board of directors.
7 minutes ago
U.S. stocks closed higher across the board yesterday, but the rebound was derailed after hours by news that Jensen Huang would be ousted.
7 minutes ago
Hot feeds
A trader profits $448K by monitoring #Binance's new listings!
2024.12.13 17:37:29
Last week, funds have flowed into #Bitcoin, #Ethereum, and #Hyperliquid.
2024.12.16 14:48:36
A $PEPE whale that had been dormant for 600 days transferred all 2.1T $PEPE($52M) to a new address.
2024.12.14 10:35:27
NFT project Ptah has launched, with its trading volume exceeding $900,000 in just half a day; its minting mechanism mandates the use of a Binance Agent ID.
2026.10.23 10:16:30
When Elon Musk tweeted about Moltbook, the meme coin MOLT experienced a short-term 30% price surge, hitting a new all-time high of $114 million.
2026.01.31 18:37:29
A smart #AI coin trader made $17.6M on $GOAT, $ai16z, $Fartcoin,$arc.
2025.01.05 16:05:18
MoreHot Articles

How did I turn $1,000 into $30,000 with smart money?
2024.12.09

10 promising AI Agent cryptos
2024.12.05

The 30-Year-Old Entrepreneur Behind Virtual, a Multi-Million Dollar AI Agent Society
2025.01.22

10 smart traders specializing in MEMEcoin trading on Solana
2024.12.09

A trader lost $73.9K trading memecoins in just 3 minutes — a lesson for us all!
2024.12.13

What is $SPORE? Let us take you through the on-chain records to show you how it works.
2024.12.25

