Slow Fog's Yu Xian Advises Against Updating to New Version of Telegram Due to Lack of Sandbox Protection

Yu Xian, the founder of Slow Fog, stated on social media that the new version of Telegram supports embedding applications in messages but lacks sandbox protection. The use of QuickJS may become a pathway for malicious code execution. He pointed out that complex features could introduce unnecessary risks, especially as current AI vulnerability exploitation capabilities have significantly improved, advising users to refrain from updating Telegram. This issue is related to the new features announced by Telegram founder Pavel Durov on November 10, which state that any Telegram message can become an application of less than 4 KB in size, supporting instant download and interactive rendering mechanisms. Security researcher V12 indicated that any Telegram message could lead to remote code execution. Researcher owarida noted that the HTML widget sandbox provided by Telegram actually runs a QuickJS interpreter on threads, lacking effective isolation measures. Once a vulnerability occurs in QuickJS, attackers could gain the same permissions as the Telegram client. This issue stems from a use-after-free vulnerability that can be triggered by standard JavaScript in the interpreter, with fixes currently only available in the main branch. QuickJS has previously experienced vulnerabilities multiple times.

This content is provided for general informational purposes only and doesn't constitute financial, investment, legal, or tax advice. Any events, rewards, online promotions, or related information mentioned herein should not be considered a recommendation, solicitation, or invitation to purchase, sell, trade, or otherwise deal in any crypto assets. Crypto assets are highly volatile and may result in loss. The availability of WEEX services, products, and related events may vary by region. You are responsible for ensuring that your participation is in accordance with applicable local laws and regulations.