The third-party Wallet (@wallet) is no longer displayed in the user interface.

This is related to the upcoming (though still not anytime soon) launch of Telegram’s built-in Gram Wallet.

@telelakel

Participants of the Digital Freedom contest must sign an agreement to receive their prize.

They are provided with the agreement file, which must be signed and sent back for review. After the verification, the winner will receive their prize.

The agreement states:

— The prize is paid in US dollars, but Telegram may pay it in USDT at a rate of 1 USDT = 1 USD.
— The winner confirms that they did not use fraud or cheating during the contest. If the agreement is violated, the prize may have to be returned.
— Telegram receives an exclusive, perpetual and unrestricted right to use the contest submission for any purpose and to transfer these rights to other parties.
— Telegram can modify or adapt the submission without additional permission from the author.
— Receiving the prize does not give the author any rights to Telegram's code or other parts of Telegram.
— Telegram is not required to actually use the submission after obtaining the rights to it.
— All taxes related to receiving the prize are paid by the winner.
— The winner releases Telegram and its related companies and individuals from claims arising in connection with the contest.
— The agreement is governed by English law, and unresolved disputes are subject to the courts of England.

@telelakel

The built-in Telegram game «Emoji Stake» was disabled on the production server on September 22. However, it is still working on the test server for now.

@telelakel

Check your ratings. The amount of Stars you've spent has been recalculated, and your rating may have increased.

@telelakel

Changes to rating calculation. Previously, if you gifted another user a gift and they later exchanged it back for Stars, the rating would decrease for both of you.

Now your rating will not change if the gifts you gave are exchanged for Stars (or the rating is still deducted from the account that exchanged the gift for Stars, but this doesn't work for me).

@telelakel

Interactive web messages right in the chat

The TBetaLeak channel discovered a large experimental subsystem called HTMLBubbles in version 12.10.283300 of Telegram for macOS.

According to the description, the messaging app is testing interactive messages built with HTML, CSS, and JavaScript right in the chat, without the need to launch a separate Web Mini App window.

@tginfo editors have confirmed the module’s presence in the code of that version based on a preliminary review, but the described behavior and how it works have not yet been independently verified.

The idea is to turn ordinary messages into widgets: product cards with selectable options, interactive boarding passes, or live charts.

According to the source, rendering is handled by the compact litehtml engine, while scripts run in a heavily restricted sandbox with CPU limits, network requests blocked, and external media prohibited. You can read all the technical details about these restrictions in the source post.

Editors’ concerns

Despite the extensive list of restrictions, @tginfo editors have serious security concerns about this kind of feature. Integrating web engines that support JavaScript execution — even in a heavily restricted form — directly into the chat interface poses a huge risk.

Experience shows that no matter how thoroughly developers isolate an environment, vulnerabilities are regularly found in rendering systems. The risk of malicious code running simply by viewing a chat raises serious questions about whether these widgets are worth it.

For now, HTMLBubbles is an early experimental concept being tested within the Telegram team. The feature could change substantially during development or be canceled entirely.

#macOS #beta

Dangerous vulnerability in Telegram Desktop: any file can be stolen with one click

What you MUST NOT do and how to protect yourself:
• Do not keep using versions earlier than 7.2.9 — update the client immediately. If you use an unofficial client, temporarily switch to the official one until an update is released.

Download:
• Windows / macOS / Linux: official website or GitHub.
• Windows: Microsoft Store.
• macOS: App Store.
• Linux: Flathub, Snapcraft.

Advice for users of older clients:

• Links can be dangerous: whenever you click a link, read the pop-up window carefully — if Telegram shows an unusual structure in the link (for example, one starting with tg://), do not open it.

• Do not use the client without a local passcode: enabling one encrypts the session files in the tdata directory, preventing immediate account hijacking even if those files are leaked.

What is the issue?

A vulnerability has been discovered in Telegram Desktop clients earlier than version 7.2.9 (CVE-2026-107181). Because the ; delimiter was not escaped, parameters in tg:// links were interpreted as separate IPC commands. Using the interpret: handler, an attacker could cause files from the system to be sent covertly to their channel, without the user’s confirmation, when the user clicked a specially crafted link.

The main risk

The danger is not limited to stealing tdata session files and hijacking accounts. Exploiting the vulnerability makes it possible to covertly steal absolutely any files on the computer that the user can access: documents, saved browser sessions, SSH keys, system configurations, or cryptocurrency wallets.

#security #desktop #vulnerabilities