Telegram found an experimental system that will allow JavaScript to run directly inside messages. Instead of the usual text, interactive applications that work without opening a browser will be able to appear in the chats. The new possibility simultaneously raises questions about the security of correspondence.
The HTMLBubbles subsystem was found in the beta version of Telegram 12.10.283300 for macOS. The developers provided support for HTML, CSS and JavaScript directly in the message area. The user will be able to press buttons, change parameters, work with graphs and interact with other elements without leaving the correspondence. While the function remains an internal experiment and is not available to ordinary users and bots.
The discovered assembly contains 64 demonstration scenarios. Among them are online shopping cards with the choice of color and size of the product, boarding passes, task lists, interactive graphics and chess. There are also more complex examples for developers, including viewing code and control panels of program builds with startup buttons and rollback of changes. Each message actually turns into a small independent interface.
The main difference between HTMLBubbles and the existing Mini Apps is the way to run. Now the mini-app opens as a separate web page inside Telegram and interacts with the server. The new mechanism involves performing scripts directly in the message, without a separate WebView window. This approach allows you to embed interactive elements into the usual correspondence feed, but at the same time transfers the execution of the program code closer to the main interface of the messenger.
To display the content, the developers chose litehtml, a compact engine for HTML and CSS processing. The library analyzes the structure of the document and calculates the location of the elements, and the text and images draw the application itself by means of macOS. Unlike a full-fledged browser, litehtml supports only a fraction of web standards. JavaScript provides a separate mechanism, not the display library itself.
The scripts are triggered in a special sandbox that should isolate the program code from the rest of the system. According to the description of the prototype, JavaScript does not access the usual browser objects document and window, cannot send requests through fetch and XMLHttpRequest or open network connections. WebSocket and localStorage are also not available. As a result of the script, you should not directly access external servers or browser storage.
Additional restrictions relate to downloadable content. HTMLBubbles blocks external images over HTTP and HTTPS, and video, audio, iframe and canvas elements ignore. For the design of cards it is supposed to use built-in resources and system icons. Such architecture reduces the capabilities of the program code, including the hidden loading of third-party content, although in itself does not guarantee the absence of vulnerabilities.
Telegram also restricted consumption of computing resources. One JavaScript call can take no more than 50 milliseconds, and the total runtime is limited to 200 milliseconds per second. At the same time up to 16 timers are allowed. If the script exceeds the set limit or ends with an error, the message must switch to a static HTML version. For the invisible elements on the screen, the animation is suspended.
However, even with such limitations, JavaScript inside correspondence creates a new attack surface. If an attacker manages to bypass the isolation or use an HTML, CSS or interface event processing error, a specially prepared message will potentially affect the client’s operation. The scale of the possible consequences will depend on the sandbox architecture, the available internal functions of Telegram and how reliable the program separates the contents of the message from its own components.
Such fears have technical grounds. In September 2026, it became known about the vulnerability of Telegram Desktop, which allowed JavaScript to be introduced through the text of the button in HTML export correspondence. The malicious code was executed when you open the saved archive in the browser, and not with the usual chat view. The mistake was corrected in Telegram Desktop 7.0.1, but the case showed how dangerous the missing processing of the untrusted contents could be.
The new mechanism differs from the previous vulnerability in principle. HTMLBubbles initially provides programmable messages, so developers need to protect not only the processing of the markup, but also the very environment of execution. The question remains whether scripts can be started automatically when a message appears on the screen or only after the user’s actions. There is no public technical description of such behavior yet.
The existence of an experimental module in the code Telegram for macOS was independently confirmed by the specialists of the Telegram Info community, but the actual work of all the declared scenarios has not yet been checked. Information about 64 demonstrations and specific restrictions is based primarily on the study of the test assembly. The official announcement of HTMLBubbles, the results of independent security audit and confirmation of the practical exploitation of vulnerabilities of the new system is not yet available.
It is also not known how users or bot developers will be able to create interactive messages, whether HTMLBubbles support will appear on Android, iOS and Windows and what restrictions will remain for public launch. Telegram did not announce the release of the function. Developers can significantly change the mechanism or completely abandon the experiment. While HTMLBubbles shows the possible direction of development of the messenger, in which the message ceases to be just text and becomes an executable interface.
The HTMLBubbles subsystem was found in the beta version of Telegram 12.10.283300 for macOS. The developers provided support for HTML, CSS and JavaScript directly in the message area. The user will be able to press buttons, change parameters, work with graphs and interact with other elements without leaving the correspondence. While the function remains an internal experiment and is not available to ordinary users and bots.
The discovered assembly contains 64 demonstration scenarios. Among them are online shopping cards with the choice of color and size of the product, boarding passes, task lists, interactive graphics and chess. There are also more complex examples for developers, including viewing code and control panels of program builds with startup buttons and rollback of changes. Each message actually turns into a small independent interface.
The main difference between HTMLBubbles and the existing Mini Apps is the way to run. Now the mini-app opens as a separate web page inside Telegram and interacts with the server. The new mechanism involves performing scripts directly in the message, without a separate WebView window. This approach allows you to embed interactive elements into the usual correspondence feed, but at the same time transfers the execution of the program code closer to the main interface of the messenger.
To display the content, the developers chose litehtml, a compact engine for HTML and CSS processing. The library analyzes the structure of the document and calculates the location of the elements, and the text and images draw the application itself by means of macOS. Unlike a full-fledged browser, litehtml supports only a fraction of web standards. JavaScript provides a separate mechanism, not the display library itself.
The scripts are triggered in a special sandbox that should isolate the program code from the rest of the system. According to the description of the prototype, JavaScript does not access the usual browser objects document and window, cannot send requests through fetch and XMLHttpRequest or open network connections. WebSocket and localStorage are also not available. As a result of the script, you should not directly access external servers or browser storage.
Additional restrictions relate to downloadable content. HTMLBubbles blocks external images over HTTP and HTTPS, and video, audio, iframe and canvas elements ignore. For the design of cards it is supposed to use built-in resources and system icons. Such architecture reduces the capabilities of the program code, including the hidden loading of third-party content, although in itself does not guarantee the absence of vulnerabilities.
Telegram also restricted consumption of computing resources. One JavaScript call can take no more than 50 milliseconds, and the total runtime is limited to 200 milliseconds per second. At the same time up to 16 timers are allowed. If the script exceeds the set limit or ends with an error, the message must switch to a static HTML version. For the invisible elements on the screen, the animation is suspended.
However, even with such limitations, JavaScript inside correspondence creates a new attack surface. If an attacker manages to bypass the isolation or use an HTML, CSS or interface event processing error, a specially prepared message will potentially affect the client’s operation. The scale of the possible consequences will depend on the sandbox architecture, the available internal functions of Telegram and how reliable the program separates the contents of the message from its own components.
Such fears have technical grounds. In September 2026, it became known about the vulnerability of Telegram Desktop, which allowed JavaScript to be introduced through the text of the button in HTML export correspondence. The malicious code was executed when you open the saved archive in the browser, and not with the usual chat view. The mistake was corrected in Telegram Desktop 7.0.1, but the case showed how dangerous the missing processing of the untrusted contents could be.
The new mechanism differs from the previous vulnerability in principle. HTMLBubbles initially provides programmable messages, so developers need to protect not only the processing of the markup, but also the very environment of execution. The question remains whether scripts can be started automatically when a message appears on the screen or only after the user’s actions. There is no public technical description of such behavior yet.
The existence of an experimental module in the code Telegram for macOS was independently confirmed by the specialists of the Telegram Info community, but the actual work of all the declared scenarios has not yet been checked. Information about 64 demonstrations and specific restrictions is based primarily on the study of the test assembly. The official announcement of HTMLBubbles, the results of independent security audit and confirmation of the practical exploitation of vulnerabilities of the new system is not yet available.
It is also not known how users or bot developers will be able to create interactive messages, whether HTMLBubbles support will appear on Android, iOS and Windows and what restrictions will remain for public launch. Telegram did not announce the release of the function. Developers can significantly change the mechanism or completely abandon the experiment. While HTMLBubbles shows the possible direction of development of the messenger, in which the message ceases to be just text and becomes an executable interface.
