{
  "schema_version": "1.0",
  "publisher": "AI Release",
  "article": {
    "title": "Telegram's HTML widgets got RCE within a week: a timeline of fixes and Durov's response",
    "canonical_url": "https://ai-release.org/posts/html-vidzhety-telegram-poluchili-rce-za-nedelyu-hronologiya-fiksov-i-o-0a8f25fd_en.html",
    "language": "en",
    "article_type": "news",
    "published_at": "2026-11-14T00:00:00+00:00",
    "updated_at": "2026-11-14T00:00:00+00:00"
  },
  "summary": "HTML widgets were opened to all bots on November 9 in Bot API 10.4 — and within the first week, the QuickJS-ng engine was patched twice due to code execution. Fixes came in waves: engine v0.6.1 (November 6) and v0.6.4 (November 10), Telegram Desktop client 7.4.2 and 7.4.3 (November 13, overnight Moscow time).",
  "topics": [
    "Telegram",
    "Security",
    "QuickJS",
    "RCE",
    "HTML-виджеты",
    "информационная_безопасность",
    "AI",
    "cybersecurity"
  ],
  "entities": [
    {
      "id": "E-SRC",
      "name": "habr.com",
      "type": "source",
      "description": "source domain",
      "url": "https://habr.com/ru/articles/1107658/"
    },
    {
      "id": "E-T1",
      "name": "Telegram",
      "type": "topic",
      "description": "publication tag",
      "url": null
    },
    {
      "id": "E-T2",
      "name": "Security",
      "type": "topic",
      "description": "publication tag",
      "url": null
    },
    {
      "id": "E-T3",
      "name": "QuickJS",
      "type": "topic",
      "description": "publication tag",
      "url": null
    },
    {
      "id": "E-T4",
      "name": "RCE",
      "type": "topic",
      "description": "publication tag",
      "url": null
    },
    {
      "id": "E-T5",
      "name": "HTML-виджеты",
      "type": "topic",
      "description": "publication tag",
      "url": null
    },
    {
      "id": "E-T6",
      "name": "информационная_безопасность",
      "type": "topic",
      "description": "publication tag",
      "url": null
    },
    {
      "id": "E-T7",
      "name": "AI",
      "type": "topic",
      "description": "publication tag",
      "url": null
    },
    {
      "id": "E-T8",
      "name": "cybersecurity",
      "type": "topic",
      "description": "publication tag",
      "url": null
    },
    {
      "id": "E-AIR",
      "name": "AI Release",
      "type": "publisher",
      "description": "published the article",
      "url": "https://ai-release.org/"
    }
  ],
  "claims": [
    {
      "id": "AR-HTMLVIDZHE-001",
      "statement": "HTML widgets were opened to all bots on November 9 in Bot API 10.4 — and within the first week, the QuickJS-ng engine was patched twice due to code execution.",
      "claim_type": "reported_fact",
      "confidence": "not_assessed",
      "source_type": "publication source",
      "verification_status": "reported_unverified",
      "source_url": "https://habr.com/ru/articles/1107658/",
      "article_anchor": "#ai-claim-001",
      "evidence_excerpt": "HTML widgets were opened to all bots on November 9 in Bot API 10.4 — and within the first week, the QuickJS-ng engine was patched twice due to code execution."
    },
    {
      "id": "AR-HTMLVIDZHE-002",
      "statement": "Fixes came in waves: engine v0.6.1 (November 6) and v0.6.4 (November 10), Telegram Desktop client 7.4.2 and 7.4.3 (November 13, overnight Moscow time).",
      "claim_type": "reported_fact",
      "confidence": "not_assessed",
      "source_type": "publication source",
      "verification_status": "reported_unverified",
      "source_url": "https://habr.com/ru/articles/1107658/",
      "article_anchor": "#ai-claim-002",
      "evidence_excerpt": "Fixes came in waves: engine v0.6.1 (November 6) and v0.6.4 (November 10), Telegram Desktop client 7.4.2 and 7.4.3 (November 13, overnight Moscow time)."
    },
    {
      "id": "AR-HTMLVIDZHE-003",
      "statement": "The attack required the user to launch the bot themselves; Telegram says the scenario was closed server-side, but there is no independent confirmation of this in the story.",
      "claim_type": "reported_fact",
      "confidence": "not_assessed",
      "source_type": "publication source",
      "verification_status": "reported_unverified",
      "source_url": "https://habr.com/ru/articles/1107658/",
      "article_anchor": "#ai-claim-003",
      "evidence_excerpt": "The attack required the user to launch the bot themselves; Telegram says the scenario was closed server-side, but there is no independent confirmation of this in the story."
    },
    {
      "id": "AR-HTMLVIDZHE-004",
      "statement": "On November 5, the Telegram Desktop 7.4.0 changelog featured exactly one line — \"HTML widgets in bots.\" Four days later, on November 9, widgets were opened to all bots in Bot API 10.4, and that same day Andreas Røsdal published an audit of the QuickJS-ng engine with 27 findings .",
      "claim_type": "reported_fact",
      "confidence": "not_assessed",
      "source_type": "publication source",
      "verification_status": "reported_unverified",
      "source_url": "https://habr.com/ru/articles/1107658/",
      "article_anchor": "#ai-claim-004",
      "evidence_excerpt": "On November 5, the Telegram Desktop 7.4.0 changelog featured exactly one line — \"HTML widgets in bots.\" Four days later, on November 9, widgets were opened to all bots in Bot API 10.4, and that same day Andreas Røsdal published an audit of the QuickJS-ng engine with 27 findings ."
    },
    {
      "id": "AR-HTMLVIDZHE-005",
      "statement": "By November 13, Telegram had released 7.4.3.",
      "claim_type": "reported_fact",
      "confidence": "not_assessed",
      "source_type": "publication source",
      "verification_status": "reported_unverified",
      "source_url": "https://habr.com/ru/articles/1107658/",
      "article_anchor": "#ai-claim-005",
      "evidence_excerpt": "By November 13, Telegram had released 7.4.3."
    },
    {
      "id": "AR-HTMLVIDZHE-006",
      "statement": "Here's the mechanics: a widget is a message with HTML and JavaScript, up to 4 KB.",
      "claim_type": "reported_fact",
      "confidence": "not_assessed",
      "source_type": "publication source",
      "verification_status": "reported_unverified",
      "source_url": "https://habr.com/ru/articles/1107658/",
      "article_anchor": "#ai-claim-006",
      "evidence_excerpt": "Here's the mechanics: a widget is a message with HTML and JavaScript, up to 4 KB."
    },
    {
      "id": "AR-HTMLVIDZHE-007",
      "statement": "The script runs in a sandbox with no network and no keyboard input, but underneath sits QuickJS, an engine written in C, and a memory-handling bug throws the script outside the sandbox.",
      "claim_type": "reported_fact",
      "confidence": "not_assessed",
      "source_type": "publication source",
      "verification_status": "reported_unverified",
      "source_url": "https://habr.com/ru/articles/1107658/",
      "article_anchor": "#ai-claim-007",
      "evidence_excerpt": "The script runs in a sandbox with no network and no keyboard input, but underneath sits QuickJS, an engine written in C, and a memory-handling bug throws the script outside the sandbox."
    },
    {
      "id": "AR-HTMLVIDZHE-008",
      "statement": "The first bug is a use-after-free in replace : the regex was rebuilt in the middle of an operation, the old bytecode was freed, and the engine kept reading it at the same address.",
      "claim_type": "reported_fact",
      "confidence": "not_assessed",
      "source_type": "publication source",
      "verification_status": "reported_unverified",
      "source_url": "https://habr.com/ru/articles/1107658/",
      "article_anchor": "#ai-claim-008",
      "evidence_excerpt": "The first bug is a use-after-free in replace : the regex was rebuilt in the middle of an operation, the old bytecode was freed, and the engine kept reading it at the same address."
    }
  ],
  "relationships": [
    {
      "subject": "habr.com",
      "predicate": "reports on",
      "object": "Telegram's HTML widgets got RCE within a week: a timeline of fixes and Durov's response",
      "claim_id": "AR-HTMLVIDZHE-001"
    },
    {
      "subject": "AI Release",
      "predicate": "publishes",
      "object": "Telegram's HTML widgets got RCE within a week: a timeline of fixes and Durov's response",
      "claim_id": "AR-HTMLVIDZHE-001"
    }
  ],
  "questions_and_answers": [
    {
      "question": "What is this article about?",
      "answer": "Telegram's HTML widgets got RCE within a week: a timeline of fixes and Durov's response. HTML widgets were opened to all bots on November 9 in Bot API 10.4 — and within the first week, the QuickJS-ng engine was patched twice due to code execution.",
      "claim_ids": [
        "AR-HTMLVIDZHE-001"
      ],
      "article_anchor": "#ai-knowledge"
    },
    {
      "question": "What happened?",
      "answer": "HTML widgets were opened to all bots on November 9 in Bot API 10.4 — and within the first week, the QuickJS-ng engine was patched twice due to code execution. Fixes came in waves: engine v0.6.1 (November 6) and v0.6.4 (November 10), Telegram Desktop client 7.4.2 and 7.4.3 (November 13, overnight Moscow time). The attack required the user to launch the bot themselves; Telegram says the scenario was closed server-side, but there is no independent confirmation of this in the story.",
      "claim_ids": [
        "AR-HTMLVIDZHE-001",
        "AR-HTMLVIDZHE-002",
        "AR-HTMLVIDZHE-003"
      ],
      "article_anchor": "#ai-knowledge"
    },
    {
      "question": "Who is the source?",
      "answer": "habr.com: https://habr.com/ru/articles/1107658/",
      "claim_ids": [],
      "article_anchor": "#ai-knowledge"
    },
    {
      "question": "What remains unknown?",
      "answer": "The article reports the cited source; independent verification and full details are not provided.",
      "claim_ids": [],
      "article_anchor": "#ai-knowledge"
    }
  ],
  "limitations": [
    "No independent verification is provided.",
    "Full details, dates and official documents may be missing.",
    "The article reports a source rather than being the primary source."
  ],
  "citation": {
    "preferred_citation": "AI Release. «Telegram's HTML widgets got RCE within a week: a timeline of fixes and Durov's response». 2026-11-14. https://ai-release.org/posts/html-vidzhety-telegram-poluchili-rce-za-nedelyu-hronologiya-fiksov-i-o-0a8f25fd_en.html",
    "canonical_url": "https://ai-release.org/posts/html-vidzhety-telegram-poluchili-rce-za-nedelyu-hronologiya-fiksov-i-o-0a8f25fd_en.html",
    "publisher": "AI Release"
  }
}