Slow Mist's Cos warns of security risks in new Telegram feature: QuickJS execution engine may have sandbox escape vulnerabilities

Odaily reports that Cos, founder of Slow Mist, has issued a warning that the new version of Telegram supports embedding interactive apps directly in chat messages, and the related feature uses QuickJS to execute JavaScript, which may increase the risk of malicious code attacks. Users are advised to upgrade with caution.

Telegram officially introduced this feature with Bot API 10.4, launched on November 9. Although the official implementation provides a QuickJS sandbox and network access restrictions, recent security research has found that the relevant execution engine previously had remote code execution vulnerabilities that could potentially break through sandbox isolation.