Telegram Runs JavaScript Code in Messages via HTMLBubbles

An experimental HTMLBubbles subsystem has been discovered in the beta version of Telegram for macOS, enabling interactive messages using HTML, CSS, and JavaScript directly within the chat feed.

The functionality operates without opening a separate Mini App window, integrating directly into the messenger's interface. The current build includes 64 demo scenarios, such as product cards with parameter toggling, boarding passes, to-do lists, and even a chess game.

Content processing is handled by the lightweight litehtml engine, which parses HTML and CSS to determine element placement, while text and image rendering are performed using macOS operating system capabilities. The engine only partially supports web standards and is not a full-fledged browser.

The sandbox enforces strict security restrictions: scripts do not have access to document, window, fetch, XMLHttpRequest objects, or sockets. External images via HTTP(S) protocols are blocked, and video, audio, iframe, and canvas tags are ignored.

• Script execution is limited to 50 ms per call and 200 ms total per second
• No more than 16 timers can run simultaneously
• If limits are exceeded or errors occur, the widget displays a static HTML version

Despite the reasonable constraints, introducing executable code into chats creates a new attack surface for potential cyberattacks, requiring careful monitoring by the information security community.

litehtml engine