Joel Eriksson (@OwariDa) “Telegram shipped a "sandbox" for HTML widgets in messages. It's an in-process Qu” — TopicDigg

Telegram shipped a "sandbox" for HTML widgets in messages. It's an in-process QuickJS (C) interpreter on a thread... No fork, no isolatedProcess, no seccomp anywhere in the tree, so any QuickJS exploit is enough to gain full control with whatever privileges the Telegram client is running as without the need for any separate sandbox escape The bug is a UaF in the interpreter, from standard JS: ```js class D { [Symbol.dispose]() {} } const d = new D(); let leak; class C { static { for (await using x of [d, d]) leak = () => x; }} // ... run anything ... leak() // reads a freed frame ``` The fix for this particular vuln is still just in the master branch, and considering the number of vulnerabilities QuickJS has had in the past, this vuln will surely not be the last...