The cryptocurrency exchange Bybit has issued an urgent security notice to its users, advising them to update the Telegram application on Android devices immediately. This recommendation follows the discovery of a vulnerability that allowed remote code execution through chat messages.
Security researchers from V12 demonstrated the flaw on November 11, showing that a malicious bot message could automatically launch the Calculator app on an Android phone. The vulnerability stems from the widget feature introduced by Telegram on November 9, which allows small applications to run within chats.
Telegram confirmed that a fix for the Android issue was deployed on November 11. While there is no evidence of active exploitation, the risk is significant for crypto users, as Telegram wallets store assets on the TON blockchain. Unauthorized code execution could potentially compromise session data and bypass two-factor authentication.
This incident marks the second remote code execution vulnerability found in the Android version of Telegram within a single month. Bybit has advised its clients to exercise caution by avoiding interactions with unknown bots, suspicious links, and unverified chat channels to protect their digital assets.
