553
Telegram’s new HTML widgets turned chat bubbles into a zero-click RCE engine
The CyberSec Guru
Telegram’s new HTML widgets run QuickJS inside the main process. See how ARG_SCOPE_END and telejam’s await using bug give zero-click RCE, and how to patch
