Telegram Restricts Bot Widgets Amid Security Dispute

Telegram has blocked general bots from sending HTML widgets, interactive tools that run inside messages, as researchers detailed security flaws in older clients and Pavel Durov said the issue had been patched server-side.

“Yes, currently, general bots aren't allowed to use widgets even in private chats,” Bot API repository contributor Aliaksei Levin, posting as levlam, wrote on Nov. 13.

Levin was responding to a developer who reported that a bot which had successfully sent widgets from Nov. 10 through part of Nov. 13 was now receiving a permission error. The confirmation concerns sending widgets—not a stated freeze on registering bots or a blanket shutdown of Telegram Mini Apps. It also does not specify whether previously delivered widgets still render, why access was narrowed or when it will return.

The restriction closes off a new interface for developers building tools and payment flows inside chats. Telegram's official BotNews announcement for Bot API 10.4 described HTML interfaces running directly in message bubbles, with TON wallet integration for signing transactions, notifying bots of transactions and reading wallet cards, including balances. Those capabilities are not evidence that a security flaw enabled unauthorized transfers.

What 'No Tap' Means

Durov said on Nov. 13 that nobody could be hacked simply by receiving a message and that users first had to actively start a third-party service. “Even that is fully patched server-side,” he wrote.

The researchers' tg-widget-rce archive describes a more specific trigger: a bot message carries HTML and JavaScript, and the widget executes when Telegram lays out the message in an open chat, without requiring a tap. Delivery requires a bot permitted to send widgets. Starting a service and tapping an individual widget are separate actions.

The archive lists affected older app versions including Telegram for Android 13.2.0, Telegram for iOS 13.2, Telegram Desktop 7.4.0 and Telegram for macOS 13.1. The researchers say the published flaws are fixed in current Telegram builds.

Their build-specific findings distinguish code execution within the Telegram app on older Android builds 72889 and 72929 from results contained in an isolated widget process on builds 72979 and 72989. They do not claim a root, kernel or bootloader exploit—so the findings should not be read as proof of full-device control.

For users who have not updated, the distinction matters: fixing client code and restricting delivery on Telegram's servers address different parts of the attack path. The archived tests do not establish that older clients remain exploitable under the current server rules, nor does Durov's statement provide a minimum safe version for every client.

Crypto exchange Bybit urged users on Nov. 13 to update Telegram immediately, avoid unfamiliar chats and unknown bots, and not open suspicious links. Its warning that a compromised device could put other apps at risk was an advisory, not a report of customer losses.