Telegram has blocked ordinary bots from sending its new interactive in-message apps, known as HTML widgets, even in private chats. A November 13 confirmation in Telegram's Bot API repository documented the restriction as researchers and Telegram disputed security concerns surrounding the feature.
Telegram Bot API contributor levlam confirmed the change, stating that general bots cannot use widgets in private chats. A developer reported receiving an INPUT_MEDIA_WIDGET_NOT_ALLOWED error after previously sending widgets successfully. The widget feature, introduced in Bot API 10.4 on November 9, allows code to run inside messages themselves rather than opening a separate interface like Mini Apps do.
The restriction applies specifically to ordinary bots and does not affect all bot services. Telegram's widget documentation describes an isolated environment that runs code on the user's device without direct internet access, with bot requests routed through Telegram's servers.
Security Concerns and Researcher Findings
Researchers from the tg-widget-rce project published vulnerability reports affecting older Telegram clients. According to their archived findings, vulnerabilities were identified in Telegram for Android, Telegram for iOS 13.2, Telegram Desktop 7.4.0, and Telegram for macOS 13.1, with different results across versions.
The researchers reported that widget code could execute during chat layout without user interaction on selected older Android builds. However, their demonstrations did not establish stolen cryptocurrency assets or widespread malicious exploitation. The technical findings distinguish app-level code execution on specific older Android versions from results contained in isolated widget processes on other platforms.
As of November 14, the researchers stated in their archive that published vulnerabilities are fixed in current Telegram builds.
Telegram's Response
Telegram founder Pavel Durov denied that receiving a message alone could compromise users, asserting that users must first start a third-party service and that the issue was fully patched server-side. Durov's statement represents Telegram's official position on the matter.
Levlam's confirmation provides no timeline for restoring widget functionality, explanation for the access narrowing, or policy regarding how previously delivered widgets will render on user devices.
