Slow Mist Cosine Warning on Telegram Security Risks: QuickJS Execution Engine May Have Sandbox Escape Vulnerabilities

Odaily Planet Daily News: Yu Xian, founder of Mantra Fog, issued a warning stating that the new version of Telegram now supports embedding interactive applications directly within chat messages, with JavaScript execution powered by QuickJS, potentially increasing the risk of malicious code attacks. Users are advised to proceed with caution when upgrading. This feature was officially introduced in Bot API 10.4, launched by Telegram on November 9. Although the official version provides QuickJS sandboxing and network access restrictions, recent security research has uncovered a remote code execution vulnerability in the underlying execution engine that could potentially bypass sandbox isolation.