Telegram's Widget Flaw, the Fix, and Durov's Dare: 'Go Hack My Account'

On 13 November 2026, Pavel Durov posted a dare on his Telegram channel: if you think Telegram has a remote code execution flaw, go and hack his own account. It was the end of a four-day story that started with a new feature, passed through a security firm's calculator demo, and ended with the founder of Telegram telling the world the flaw does not exist — while also saying it is fully patched. The short version On 9 November, Telegram shipped HTML widgets for bots — small apps that run inside a chat message On 11 November, security firm V12 showed a widget message opening the Calculator app on an Android phone — the classic proof of remote code execution Telegram pushed a server-side patch within hours, and the client fix landed in Telegram for Android 13.2.2 On 13 November, Durov said the flaw "doesn't exist" as described — and challenged hackers to break into his own account, t.me/monk No CVE has been assigned, and no in-the-wild attacks have been confirmed Durov has dared hackers before This is not the first time Durov has invited the world to break Telegram. In December 2013, he offered $200,000 in Bitcoin to anyone who could break Telegram's MTProto encryption protocol. Two days later, a researcher on the Russian forum Habr — user x7mz — found a weakness in how secret chats handled nonces and collected $100,000. A second contest, with a $300,000 prize, ended in February 2015 with no winners at all. Telegram's bug bounty has run continuously since 2014, paying $100 to more than $100,000 per report. The 13 November dare is different from those contests in one important way: there is no prize, no scope and no deadline in the post. It is a dare, not a competition — a public bet that nobody can do what the reports claim. What widgets are — and why they mattered Widgets arrived with Bot API 10.4 on 9 November 2026. A widget is a single self-contained HTML document — at most 32 KB, 4 KB after compression — that a bot sends inside a message. It renders natively in the chat: a live poll, a price ticker, a two-player board game, a promo code. Its JavaScript runs in QuickJS, a small JavaScript engine, inside a sandbox with no network access at all. Network calls throw an error; the widget's only way out is a 64-byte request to its bot. In production, widgets work only in private chats with the bot. They can also take payments in Gram, the TON blockchain's currency, through Telegram's own non-custodial wallet. Durov announced them on 10 November with a line V12 would later throw back at him: "Any Telegram message can now become an app." The widget flaw was also the second Android code-execution scare for Telegram in a single month. On 29 October 2026, the firm NebuSec disclosed a memory-corruption flaw in Telegram's voice and video calls, affecting Android versions 8.6.2 to 12.10.3. An attacker needed only a regular Telegram account, and the victim only had to answer a call — NebuSec's demo showed the victim's phone displaying "HACKED BY NEBUSEC" about 30 seconds after answering. Telegram said it had already patched the flaw in version 12.10.4 in late September, before NebuSec's report, and neither side demonstrated a working remote code execution chain. No CVE was assigned for that flaw either. What happened on 11 November At 11:00 UTC on 11 November, V12 — a company that builds AI agents for finding vulnerabilities, founded by Jasraj Bedi, co-founder of the auditing firm Zellic — posted a video. A user opens a chat with a bot and taps Start. A widget message appears with a countdown: 3, 2, 1, BOOM. The phone's Calculator app opens. In security research, the Calculator is the traditional proof that an attacker is running their own code on the device, outside the sandbox. V12's caption swapped the last word of Durov's announcement: "Any telegram message can now become RCE." V12 published a video and a short post only — no technical details, no exploit code. Its post carried a 64-character hexadecimal string, the length of a SHA-256 hash, which is how researchers pin down a report's contents to prove priority later without revealing them. V12 never explained what was hashed. The most-cited technical explanation points to a memory bug in QuickJS. According to Gram News, working from Telegram's public QuickJS fork, the bug is a use-after-return: the parser accepted await using in a for head outside async functions, so an await instruction ended up in an ordinary function — and on exit the interpreter took the path meant for generators, skipping the step that detaches closures from the function's variables. Closures kept pointing at a region of the stack that no longer existed. The matching fix, commit ca3594d, is dated 10 November at 13:16 UTC — 21 minutes before Durov's post announcing widgets. The link between that commit and V12's demo rests on matching descriptions only: the commit names no researcher, and V12 has published no write-up. One thing to be careful about: a separate, independent GitHub repository published a different parser bug on the same day and pointed at the same commit. The two accounts cannot both be a complete description of one commit, and they have not been reconciled. This post does not present them as the same bug. What the flaw could have meant in practice is worth stating plainly. Code running with Telegram's privileges could, in theory, reach the data that keeps an account logged in — and two-factor authentication protects new logins, not an already-authorised session. That is theory, not evidence: as of 12 November, no one had reported attacks in the wild, and there was no evidence the flaw was used for actual account hacks. Then he fixed it Telegram moved fast. Its public reply after the demo read: "This issue in Telegram for Android was fixed yesterday, and today the fix was rolled out to all users." CryptoBriefing reports the company pushed a server-side patch to all users on 11 November, within hours of the demonstration. A server-side fix lives on Telegram's own infrastructure, so users did not need to update anything. Exactly what the server-side patch did has not been publicly described, and the fix and rollout dates differ by a day depending on the source — so this post will not state a single date as fact. The client fix is Telegram for Android 13.2.2 (build 7303). But the main change in 13.2.2 is not a single line in the parser — it is a new boundary. The release touches 96 files and about 6,800 lines, most of it moving widget code into a separate isolated process called :widgets. That process runs the widget's JavaScript, the validator and the renderer. It has no Android permissions, no network access and no access to the app's files — no accounts, no messages, no keys. The main Telegram process no longer loads the engine library at all. Everything the widget process sends back is treated as untrusted: the client re-checks links, text copying, bot requests and wallet calls itself — one link per one real tap. A seccomp system-call filter sits on top, currently in logging mode, while launching programs and creating processes are already refused. There is one process for all widgets rather than one per bot, because each costs about 25 MB of memory. The isolation separates widget code from the app's data — but not widgets from each other. If a similar bug turns up in QuickJS again, code execution lands in a process that holds neither the account nor the chats. Three caveats belong here. First, five more QuickJS memory fixes from 10 November reportedly did not make it into 13.2.2. Second, Telegram Desktop 7.4.2, released on 11 November, was reportedly built without the fix — a single claim from Security Lab that Telegram and other outlets have not confirmed; Desktop 7.4.3 came out on 12 November and whether it contains the fix is not established. One unverified repost claims a second demo on Telegram Desktop 7.4.3 — no reputable outlet had confirmed it as of 13 November. Third, whether merely receiving a message could have exploited the flaw is unresolved: V12's demo needed at least opening the bot chat and tapping Start, and V12 never said whether a tap was required. Gram News' practical advice still stands: until you update, do not open chats and channels where unfamiliar bots and people send widgets. Then he challenged On 13 November, Durov posted on his channel. His exact words: Re alleged RCE in new TG Android/Windows widgets: The issue doesn't exist. No one could be hacked just by receiving a message. You had to actively start a third-party service first. ✅ Even that is fully patched server-side. Think otherwise? Go hack my account: t.me/monk 🍿 His argument has three parts. The issue does not exist as described — not as a receive-a-message-and-get-hacked flaw. Exploitation required the victim to actively start a third-party service first — a precondition he does not define in the post, and no source has defined since. And even that path is fully patched server-side. The dare is the proof: if you disagree, break into his own account. There is a tension in the post worth noticing, and other outlets noticed it too. Durov says the issue "doesn't exist" and in the same breath that it is "fully patched server-side". Telegram had, days earlier, acknowledged that an Android issue was fixed and deployed — the company admitted an issue while Durov denied the described issue. The post names no researcher, no bug, no version and no CVE. The reactions split. Crypto exchange Bybit told users on 13 November to update Telegram on Android immediately, warning that "a compromised device could also put other apps at risk", and to avoid unknown bots, chats and links. SlowMist founder Cosine had warned a day earlier that the new message-apps lacked sandbox protection and that AI-assisted vulnerability discovery had advanced sharply — he advised users to delay updating, advice that only helps on a version older than widgets, which cannot run them at all. CryptoBriefing put it best: Durov's dare is, in effect, a public stress test. If his account stays untouched, it is a quiet point in Telegram's favour. If someone succeeds, the company will have a much louder problem than a disputed bug report. What to do now Update Telegram for Android to 13.2.2 or newer. Update the desktop and iOS apps too — their status was never clearly addressed, and the latest version is the only certain fix. Do not start bots you do not know. The demo needed at least a Start tap in a bot chat. Unknown bots, unfamiliar chats and forwarded widgets are the risk. Do not open widget-heavy chats until you have updated. A widget's code runs when its bubble is shown in the chat. Do not panic about messages you already received. No in-the-wild attacks have been confirmed, and Durov says receipt alone could never hack anyone. The dispute is about the exact preconditions, not about a wave of hacked accounts. Post Continues... Telegram RCE: Durov Dares Hackers to Try | Hack The Planet A Telegram widget ran code on Android phones. Pavel Durov said the flaw doesn't exist as described — and dared hackers to break into his own account. hackthepalnte.co.uk