ZalexDev Blog

I am strongly recommending not to update >7.4.1

The QuickJS implementation in telegram, is absolutely unsandboxed

There are so many bugs in it. And so much surface to get RCE, LPE etc.

I don't know how that's possible in such popular client like telegram

Very disappointed at security here..

Telegram released HTML widgets a day ago

Now we have an RCE from it

Who WoUlD hAvE tHoUgHt oF tHaT, absolutely NOT a clear new vector for attacks 🫩