Telegram Info English

Dangerous vulnerability in Telegram Desktop: any file can be stolen with one click What you MUST NOT do and how to protect yourself: • Do not keep using versions earlier than 7.2.9 — update the client immediately. If you use an unofficial client, temporarily switch to the official one until an update is released. Download: • Windows / macOS / Linux: official website or GitHub. • Windows: Microsoft Store. • macOS: App Store. • Linux: Flathub, Snapcraft. Advice for users of older clients: • Links can be dangerous: whenever you click a link, read the pop-up window carefully — if Telegram shows an unusual structure in the link (for example, one starting with tg://), do not open it. • Do not use the client without a local passcode: enabling one encrypts the session files in the tdata directory, preventing immediate account hijacking even if those files are leaked. What is the issue? A vulnerability has been discovered in Telegram Desktop clients earlier than version 7.2.9 (CVE-2026-107181). Because the ; delimiter was not escaped, parameters in tg:// links were interpreted as separate IPC commands. Using the interpret: handler, an attacker could cause files from the system to be sent covertly to their channel, without the user’s confirmation, when the user clicked a specially crafted link. The main risk The danger is not limited to stealing tdata session files and hijacking accounts. Exploiting the vulnerability makes it possible to covertly steal absolutely any files on the computer that the user can access: documents, saved browser sessions, SSH keys, system configurations, or cryptocurrency wallets. #security #desktop #vulnerabilities

Interactive web messages right in the chat The TBetaLeak channel discovered a large experimental subsystem called HTMLBubbles in version 12.10.283300 of Telegram for macOS. According to the description, the messaging app is testing interactive messages built with HTML, CSS, and JavaScript right in the chat, without the need to launch a separate Web Mini App window. @tginfo editors have confirmed the module’s presence in the code of that version based on a preliminary review, but the described behavior and how it works have not yet been independently verified. The idea is to turn ordinary messages into widgets: product cards with selectable options, interactive boarding passes, or live charts. According to the source, rendering is handled by the compact litehtml engine, while scripts run in a heavily restricted sandbox with CPU limits, network requests blocked, and external media prohibited. You can read all the technical details about these restrictions in the source post. Editors’ concerns Despite the extensive list of restrictions, @tginfo editors have serious security concerns about this kind of feature. Integrating web engines that support JavaScript execution — even in a heavily restricted form — directly into the chat interface poses a huge risk. Experience shows that no matter how thoroughly developers isolate an environment, vulnerabilities are regularly found in rendering systems. The risk of malicious code running simply by viewing a chat raises serious questions about whether these widgets are worth it. For now, HTMLBubbles is an early experimental concept being tested within the Telegram team. The feature could change substantially during development or be canceled entirely. #macOS #beta

Wallet bot renamed as Walt — and disappears from the app menu as Telegram prepares its own replacement On September 28, 2026, users noticed that Telegram had stopped promoting Wallet. The bot itself had been renamed Walt and given a new logo that no longer made it look like an official Telegram service. In 2023, Telegram and the TON Foundation publicly announced a partnership, and the Wallet bot was closely integrated into the messaging app. In particular, Telegram began displaying the wallet in the app’s menu, promoting it to all its users. The Wallet bot was launched in 2022 by a company associated with the TON Foundation. At the time, the @tginfo editors expressed the view that Wallet was being developed in close cooperation with Telegram. Today, the company that owns the Wallet bot is known as TOP (The Open Platform). The @tginfo editors link these changes to the Telegram team’s preparations to launch its own Gram Wallet, which will become the primary wallet for Telegram users. The history of Telegram Open Network (TON) and Gram In the view of the @tginfo editors, the TON Foundation and the Wallet bot, now known as Walt, are the result of a hybrid strategy Telegram pursued because of the SEC’s 2020 ban on developing TON. Telegram is now replacing the bot with the fully integrated Gram wallet, in line with the original 2019 vision. Telegram may have decided to take back direct control of the blockchain thanks to the significant deregulation of cryptocurrencies in the US in recent years. Preparations for launch and investment The first rumors about the Telegram Open Network (TON) blockchain and its cryptocurrency, Gram, both developed by the Telegram team, surfaced in 2017. In 2018, Telegram held a private ICO and raised about $2 billion. At the time, some

Improvements to Video Messaging on Android In the beta version of Telegram for Android for the upcoming 12.10.4 update, a new section called "Round Video (Experimental)" has been added to the settings. That page includes several experimental features that allow you to set the focus and smoothness of video messages recorded using the modern Camera2 API: • Output resolution: 360p / 480p. • Camera resolution: Low / Medium / High. • Frame rate: 30 FPS / 60 FPS. • Video bitrate: 750 kbps / 1 Mbps / 1.5 Mbps / 2 Mbps. ⚠️ Please note: Telegram notes that 60 FPS is used only if both the front and back cameras on the device support this frame rate. Otherwise, recording automatically switches to 30 frames per second. In addition, users can disable the app's custom styling for downloaded video messages. In that case, the recorded "circle" will be saved to the device as an uncropped square, without any blurring or darkening around the borders and without the Telegram logo. ⚠️ Please note: This option does not alter the appearance of video messages that are sent to chats; the "circles" within the messenger remain circular regardless of whether you have disabled their stylization during the download process. UPD: The messenger remembers the user's last selection and starts recording the next video message using the same camera that was used to record the previous video. This avoids the need to constantly switch between the front camera and the back camera when you start taking new "circles." This settings section probably won't be in stable versions of Telegram. It will only be in the beta version while the features are being tested. Subscribe to our second channel @BetaInfo to be the first to know about upcoming Telegram updates. #Android #Beta

Welcome Messages, Article Buttons, New Table Options The August Telegram update coincides with the messenger's 13th birthday: the mobile apps have updated to version 12.10, while Telegram Desktop has received a version 7.1 update. This update introduces the following features: • Welcome Messages: Admins can set and edit up to 3 welcome messages in their groups and channels. The message appears for the user when they join the chat or channel, but it is ephemeral and invisible to other members. To set a welcome message, open group or channel Settings > Welcome Message. Only the owner and admins with “Manage Welcome Messages” permission can change this setting. Even if you are an admin who had full permissions in a chat or channel, this permission is not granted by default. • Buttons in Articles: Users can now turn part of the text in paragraphs into buttons that are styled to look like links. The feature is available in the built-in full-screen article editor on Android and Desktop, but not iOS. The buttons can currently perform three types of actions: Link, Copy, or User Profile. The created button can be configured — for example, the style of the button can be set to dangerous (red), success (green), or primary (theme accent color). On Android you can set the style by tapping the link-button a few times, until you get the needed color. Keep in mind: Together with inline buttons, Telegram introduced full-sized buttons in articles. There are differences in how they are created across platforms: • Android: Type the / symbol and select “Button” in the dropdown menu. • iOS: Tap “+” and select “Button Row”. • Desktop: Tap 🔗 and choose “Button”. • New Table Formatting Options: The Rich Text tables received a few extra options: you can now remove cell borders or

Telegram Desktop updated to version 7.1.1 What's new: • Added welcome messages for groups and channels. • Added buttons and files in articles. • Improved lists, tables, and Markdown text pasting in the article editor. • Added self-destruct timers and view-once feature for photos and videos. • Added video profile picture upload for users, chats, and channels. • Added a video editor with the ability to trim and crop the clip, change its quality, and set a cover. • Added the ability to restore open windows and chats upon restart. • Added new keyboard shortcuts to restore closed windows (Ctrl + Shift + T), as well as to open the article editor (can be assigned in Settings › Chat Settings › Keyboard shortcuts). • Added the ability to send music files via the attachment menu. • Added a new proxy type called WEB in the Connection settings. • Fixed bugs that caused crashes. Download: • Windows/macOS/Linux: official website or GitHub  • Windows: Microsoft Store  • macOS: App Store  • Linux: Flathub, Snapcraft #update #Desktop