SlowMist founder Yu Xian warned that Telegram’s new feature for embedding interactive apps in chat messages may pose security risks and advised users to be cautious about upgrading.

According to Odaily, Telegram introduced the feature in Bot API 10.4, released on November 9, and uses QuickJS to execute JavaScript. Although Telegram provides a QuickJS sandbox and restricts network access, recent security research found that the engine had previously contained a remote code execution vulnerability that could potentially bypass sandbox isolation.