Telegram restricts new in-chat apps amid hacking concerns

Telegram has introduced a restriction that prevents general bots from sending interactive in-message applications, known as HTML widgets, even within private chats. This update follows a confirmation in the platform's Bot API repository on November 13, responding to developer reports of failed widget messages returning specific error codes.

The feature, which was introduced through Bot API 10.4 on November 9, allows widgets to run inside messages through an isolated environment on the user's device. Unlike traditional Mini Apps that open web pages on demand, these widgets execute code without direct internet access while routing requests through Telegram. The documented design also includes wallet connection capabilities, allowing interactions with TON wallet cards and transaction notifications for crypto users.

Telegram has blocked ordinary bots from sending new interactive HTML widget apps in private chats.

Security researchers examining the tg-widget-rce archive detailed older-client vulnerabilities affecting specific builds across Android, iOS, macOS, and desktop versions, noting that these issues are already fixed in current builds. While researchers reported that widget code could execute during chat layout without requiring a user tap, they emphasized that successful delivery requires a permitted bot and depends on the specific client version.

Telegram founder Pavel Durov disputed claims that merely receiving a message could compromise a device, asserting that users must actively start a third-party service and noting that the issue has been patched server-side. Meanwhile, repository contributor levlam confirmed the access limitation for general bots without providing a restoration timetable or policy details regarding previously delivered widgets.

Why it matters

This restriction alters how developers and users interact with messaging features that integrate blockchain wallet cards and transaction data. While researchers and the platform's founder offered differing perspectives on the severity of older client flaws, the decision limits general bot capabilities while server-side remediations and client updates are addressed.