Forwarded from Telegram Info English (Sominemo)
Interactive HTML Messages Are Now Working in the Android App
A working prototype of the experimental HTMLBubbles technology is confirmed in the Beta version of Telegram for Android 13.2.
It makes it possible to create interactive messages built with HTML, CSS, and JavaScript that are displayed right in the chat without opening a separate Mini App. To test the feature, @tginfo editors created their own HTML widget. Using it, they confirmed the execution of JavaScript and basic functions of regular websites.
Similar components were also found in the Beta version of Telegram for iOS 13.2, which now includes built-in tools for testing widgets as well.
Security concerns
So far, no dedicated toggle to disable HTMLBubbles has been found in the settings of the tested Beta versions.
Previously, @tginfo editors expressed concerns about executing JavaScript right in the chat.
As a reminder, a vulnerability (CVE-2026-107181) was recently discovered in Telegram Desktop that allowed files to be stolen through specially crafted links.
Although that flaw is unrelated to HTMLBubbles, introducing a new mechanism for executing code inside messages could lead to much more severe vulnerabilities that require no user interaction to trigger (zero-click).
When will the feature be available to everyone?
For now, HTMLBubbles remains an experimental technology. The ability to send such messages is restricted, and a public API for developers has not yet been introduced.
#Android #iOS #beta
A working prototype of the experimental HTMLBubbles technology is confirmed in the Beta version of Telegram for Android 13.2.
It makes it possible to create interactive messages built with HTML, CSS, and JavaScript that are displayed right in the chat without opening a separate Mini App. To test the feature, @tginfo editors created their own HTML widget. Using it, they confirmed the execution of JavaScript and basic functions of regular websites.
Similar components were also found in the Beta version of Telegram for iOS 13.2, which now includes built-in tools for testing widgets as well.
Security concerns
So far, no dedicated toggle to disable HTMLBubbles has been found in the settings of the tested Beta versions.
Previously, @tginfo editors expressed concerns about executing JavaScript right in the chat.
As a reminder, a vulnerability (CVE-2026-107181) was recently discovered in Telegram Desktop that allowed files to be stolen through specially crafted links.
Although that flaw is unrelated to HTMLBubbles, introducing a new mechanism for executing code inside messages could lead to much more severe vulnerabilities that require no user interaction to trigger (zero-click).
When will the feature be available to everyone?
For now, HTMLBubbles remains an experimental technology. The ability to send such messages is restricted, and a public API for developers has not yet been introduced.
#Android #iOS #beta
👍19🤡9🤬3👀2