Slow Fog Yuxian Warning Telegram chat embedding feature may contain malicious code risks

The founder of Slow Fog, Yuxian, issued a warning stating that the new version of Telegram supports directly embedding interactive applications in chat messages. The related functionality uses QuickJS to execute JavaScript, which may increase the risk of malicious code attacks, and users are advised to upgrade with caution.

The Bot API 10.4 officially introduced this feature on November 9. Although the official version provides a QuickJS sandbox and network access restrictions, recent security researchers have discovered that the related execution engine previously had a remote code execution vulnerability that could potentially break the sandbox isolation.