Cos(余弦)😶‍🌫️ (@evilcos) “新版 Telegram 支持消息里带“应用”，但没有沙盒保护，使用的 QuickJS 有可能成为恶意” — TopicDigg

Telegram shipped a "sandbox" for HTML widgets in messages. It's an in-process QuickJS (C) interpreter on a thread... No fork, no isolatedProcess, no seccomp anywhere in the tree, so any QuickJS exploit is enough to gain full control with whatever privileges the Telegram client is running as without the need for any separate sandbox escape The bug is a UaF in the interpreter, from standard JS: ```js class D { [Symbol.dispose]() {} } const d = new D(); let leak; class C { static { for (await using x of [d, d]) leak = () => x; }} // ... run anything ... leak() // reads a freed frame ``` The fix for this particular vuln is still just in the master branch, and considering the number of vulnerabilities QuickJS has had in the past, this vuln will surely not be the last...