Telegram stops ordinary bots from sending HTML widgets while Durov and researchers dispute a ‘no-tap’ flaw

Telegram has stopped ordinary bots from sending its new HTML widgets, four days after launching them. Since about 15:50 UTC on Friday 13 November, every attempt by a regular bot to send a Telegram widget fails with the error INPUT_MEDIA_WIDGET_NOT_ALLOWED, according to a developer report on the Bot API’s public GitHub tracker. Three hours later the account of the Bot API maintainer confirmed it: “general bots aren’t allowed to use widgets even in private chats.”

No reason was given. The cut came the same day Pavel Durov, Telegram’s founder, answered claims by a security firm and an independent researcher that a widget could run code on a phone as soon as the message appeared on screen, without a single tap. Durov wrote that the issue “doesn’t exist” and, in the same post, that it was fully patched on the server side.

Crypto outlets have read the restriction as a response to that dispute. That link is their inference: neither the maintainer’s reply nor any Telegram statement makes it. No theft of funds or data has been shown.

Crypto users have a stake in the answer because the widgets came with hooks into TON wallets. A widget can ask for the user’s TON wallet card, for data signed by that wallet, or report a transaction sent from it.

Telegram widgets: what Bot API 10.4 added on 9 November

Widgets arrived with Bot API 10.4, dated 9 November 2026 in Telegram’s Bot API changelog. The release added a Widget class and methods called sendWidget, sendSharedWidget, answerWidgetQuery and editMessageWidgetData, plus a WidgetQuery object that carries what a user does inside the widget back to the bot. Durov promoted it the next day at 12:59 UTC on his channel: “Any Telegram message can now become an app.”

Telegram’s widget guide describes the format. A widget is a single HTML document with its CSS and JavaScript written inline, limited to 32 KB, or 4 KB once compressed. The Telegram app runs it on the device, inside a sandbox that Telegram says has no network access at all. The widget cannot change its own state. It can send the bot requests of up to 64 bytes, and the bot answers and updates it.

Two limits were there from day one. In production, widgets could be sent only to private chats with the bot, and their content is protected, so a widget cannot be forwarded. The guide adds that the feature is rolling out in steps.

The TON wallet hooks

The part that concerns crypto users sits in the same changelog. A widget query can include, next to the data meant for the bot, the TON wallet card of the user, a piece of data the user signed with a TON wallet, or a notice that the user sent a transaction from a TON wallet. Bot API 10.4 added the classes TonWalletTransfer and TonWalletCard, and a new message entity type, ton_address.

The widget guide goes one step further. A widget can call a sendTransaction function that asks the user to send a TON transaction in the TON Connect format, up to 255 messages at once. The user confirms or declines it in a wallet window, and the widget only learns the result.

So a widget can work as a small payment or login screen inside a chat. TON already lives inside Telegram: Durov wrote on 11 November that more than 1 million self-custodial Gram wallets had been activated in the app in 48 hours. Our page on Gram, formerly Toncoin (TON) covers the network itself.

The no-tap claim and what was shown

On 11 November the firm V12, which builds AI agents that hunt for vulnerabilities, posted a video in which a widget message shows a countdown and an Android phone then opens its Calculator app, according to a timeline published on DEV Community. The caption, as DEV Community reported it, read “Any telegram message can now become RCE”, a twist on Durov’s launch line, RCE meaning remote code execution. The video showed no data being taken. V12 has not published technical details.

A second, separate record appeared on GitHub the same day. A researcher using the handle davtur19 published an archive called tg-widget-rce describing how widgets are drawn: the HTML is laid out with the litehtml library and the JavaScript runs in QuickJS-ng when the chat is open. The archive says the widget executes as the message is laid out and that “no tap is required”.

Its main entry is a parser bug that the author scores 9.6 and 8.8 on the CVSS severity scale. These are the author’s own scores. The archive lists affected older builds of Telegram for Android (72889, 72929, 73029 and 73039), iOS 13.2, Telegram Desktop 7.4.0 and macOS 13.1, along with smaller bugs, and reports its own tests on a Sony Android phone and two iPhones. It names commit ca3594d in Telegram’s fork of QuickJS as the fix; GitHub dates that commit 13:16 UTC on 10 November, the day before V12’s video.

The archive calls itself an n-day record, meaning a write-up of flaws already patched, and says everything in it is fixed in current builds. It also says that findings not yet fixed are kept in a private archive and that a report for Telegram exists outside the repository. CryptoSlate, which read it, notes that code reached the app itself only on some older Android builds and stayed inside an isolated widget process on others.

No one outside has confirmed the bugs, and there is no CVE number. Nor does the archive prove that V12’s Calculator video used the same bug. DEV Community, which tied the fix commit to the demo, writes that the match rests on matching descriptions only.

Durov: “No one could be hacked just by receiving a message”

Telegram first answered through a statement that DEV Community quotes without saying where it was published: the issue in Telegram for Android had been fixed one day and the fix rolled out to all users the next. CryptoBriefing reported that the fix reached all users on 11 November and that Telegram had seen no confirmed exploitation or data theft.

Durov went further at 16:02 UTC on 13 November in a post on his Telegram channel about the “alleged RCE in new TG Android/Windows widgets”, which had passed 913,000 views by Sunday morning. “No one could be hacked just by receiving a message,” he wrote. He said a user first had to actively start a third-party service, without saying what that means in practice, and that even this path was fully patched server-side. He ended with a dare to anyone who disagreed: hack his own account.

The two halves of the post pull in different directions. A flaw that does not exist does not need a patch. Read together, Durov’s position appears to be that the danger was smaller than claimed, because the user had to act first, and that it is closed in any case. The researcher’s archive says the opposite on the first point, and CryptoSlate points out that starting a service and tapping a widget that has arrived are separate steps. Neither side has published proof that settles it.

Bots lose widgets minutes before Durov’s post

The developer who opened issue 947, user Ivantseng123, wrote at 16:36 UTC on 13 November that the bot had sent about 120 widgets between 10 November and about 10:00 UTC on 13 November. From about 15:50 UTC, every sendWidget call to a private chat failed, some 12 minutes before Durov posted. The error code is not in Telegram’s documentation, which lists only errors for widgets that are too large or invalid.

At 18:55 UTC the levlam account, which maintains the Bot API, replied that general bots are currently not allowed to use widgets, even in private chats. The reply gives no reason and no date for a return. A later commenter, baltic-tea, wrote at 21:47 UTC that Telegram had also disabled widget delivery and rendering on its servers; Telegram has not confirmed that.

CryptoSlate and The Defiant, which reported the restriction early on 15 November, both note that it covers HTML widgets only. Ordinary bot messages work, and The Defiant, citing an unnamed Bot API contributor, describes the measure as narrower than a freeze on mini apps. The wording “general bots” leaves open whether some bots can still send widgets. The researcher’s archive, written before the cut, already said that a bot or account that is not whitelisted gets the same error.

What it means for TON wallets, mini apps and trading bots

Telegram hosts much of the crypto tooling that ordinary users touch every day: TON wallets built into the app, mini apps that sell tokens or run games, signal channels and trading bots that hold keys or ask users to connect a wallet. A bug that lets a message run code in the chat app would touch all of them, because the wallet and the chat share the same device and often the same app.

That remains a hypothesis here. Nobody has shown that the TON wallet hooks could be abused, or that a widget could reach a wallet’s keys. The archive’s claims concern the client’s HTML and JavaScript engines, not the wallet functions, and a widget’s transaction request still goes through a wallet window the user must approve. The risk crypto users already know, a bot or link that tricks them into signing a transfer, does not need any bug at all.

Earlier this month a similar pattern played out with iPhones: Bitquery traced USDT drained from TRON wallets, and the link to a zero-click iOS exploit rested on one victim. Claims of no-click attacks spread fast, and the evidence often arrives later or not at all.

What users and bot builders can do now

Durov says the problem is patched on Telegram’s servers, and the archive says current app builds carry the fixes. The practical steps cost little:

• Update Telegram on every device, Android, iOS, desktop and macOS, since the archive lists older builds on all four.
• Do not start bots or services you do not know: by Durov’s own account, starting a third-party service was the step the attack needed.
• Never sign a wallet request you did not start yourself, and read what a signature authorises before approving it.
• Treat any bot or widget asking for a TON wallet signature as you would a transaction, because it may be one.

For older approvals given to apps on other chains, our six-step routine to revoke token approvals applies just as well after a scare like this one.

Bot builders who had moved features to widgets need a fallback for now: inline keyboards, mini apps or plain messages. The maintainer has not said when, or whether, access will return.

What to watch next

The next signal will come from Telegram itself. It could restore widgets for all bots, which would suggest the measure was a pause rather than a policy. It could publish a post-mortem, or a CVE could be assigned, which would settle what the bugs were and which builds carried them. V12 could also release its method, which would show whether the user had to do anything before the code ran.

For TON holders, the other date on the calendar is unrelated to widgets: the freeze on 1.08 billion early TON coins ends on 21 February 2027.