Telegram founder and CEO Pavel Durov has publicly invited anyone to try breaking into his personal Telegram account, saying a reported security flaw in the app's new widgets has been fixed. The challenge followed a proof-of-concept demonstration and a same-day server-side patch, and it shifts attention from the technical fix to an open dispute over how severe the problem actually was.
What happened
Around November 9 to 10, Telegram rolled out HTML widgets for its Android and Windows apps. The widgets support interactive features inside the messaging app, including payments.
On November 11, researchers at the security firm V12 demonstrated a proof-of-concept for a remote code execution (RCE) vulnerability tied to the widgets. Telegram responded quickly, pushing a server-side patch to all users on November 11, within hours of the demonstration. Because the fix was applied server-side, on Telegram's own infrastructure, users did not need to update their apps.
On November 13, Durov addressed the issue personally. He pushed back on claims that the flaw allowed attackers to compromise someone simply by sending them a message. According to Durov, exploitation required an active third-party service to be initiated first, and he argued the vulnerability did not exist in the form in which it had been described.
Telegram has said there were no confirmed exploitations or data theft linked to the reported flaw, and no successful in-the-wild attacks tied to the issue have been reported.
Why the stakes are higher than a routine bug report
Telegram is expanding deeper into payments and crypto wallets, which makes questions about whether its features can be weaponized more consequential than an ordinary vulnerability disclosure. The security incident coincided with more than 1 million new integrated wallets appearing within just 48 hours.
Disputed severity
The central disagreement is over classification. V12's proof-of-concept framed the issue as a remote code execution risk. Durov's account — that a third-party service had to be active first — would sharply narrow the set of users who could realistically be affected.
For Telegram, the immediate damage appears contained: the flaw was demonstrated, patched the same day, and no attacks have been confirmed. Durov's invitation to test his own account functions as a public stress test. If his account remains untouched, it is a quiet point in Telegram's favor; if someone succeeds, the company will face a far louder problem than a disputed bug report.
