BTC $73,506.75 -0.39%
ETH $2,041.89 -1.18%
BNB $673.58 -0.98%
XRP $1.03 -1.66%
SOL $82.74 -0.33%
TRX $0.3170 -0.19%
DOGE $0.0669 -1.82%
ADA $0.1723 -1.57%
BCH $228.56 -0.74%
LINK $10.06 -3.11%
HYPE $71.70 -0.45%
AAVE $117.89 -4.95%
SUI $0.8146 -1.49%
XLM $0.1463 +0.84%
ZEC $978.55 -3.71%
AAPL $356.08 +2.23%
AMZN $266.51 -2.56%
GOOGL $294.83 +1.10%
MSFT $521.16 -2.78%
META $628.03 -3.30%
NVDA $160.38 -7.38%
TSLA $386.27 -0.04%
SNDK $937.50 +3.58%
INTC $60.18 0.00%
SPCX $139.18 -4.40%
MU $779.59 +2.49%
AMD $559.76 +4.17%
BTC $73,506.75 -0.39%
ETH $2,041.89 -1.18%
BNB $673.58 -0.98%
XRP $1.03 -1.66%
SOL $82.74 -0.33%
TRX $0.3170 -0.19%
DOGE $0.0669 -1.82%
ADA $0.1723 -1.57%
BCH $228.56 -0.74%
LINK $10.06 -3.11%
HYPE $71.70 -0.45%
AAVE $117.89 -4.95%
SUI $0.8146 -1.49%
XLM $0.1463 +0.84%
ZEC $978.55 -3.71%
AAPL $356.08 +2.23%
AMZN $266.51 -2.56%
GOOGL $294.83 +1.10%
MSFT $521.16 -2.78%
META $628.03 -3.30%
NVDA $160.38 -7.38%
TSLA $386.27 -0.04%
SNDK $937.50 +3.58%
INTC $60.18 0.00%
SPCX $139.18 -4.40%
MU $779.59 +2.49%
AMD $559.76 +4.17%

慢雾余弦警告 Telegram 聊天嵌入功能或存恶意代码风险

2026-11-12 08:45:26

ChainCatcher 消息,慢雾创始人余弦发文警告,Telegram 新版本支持在聊天消息中直接嵌入交互式应用,相关功能采用 QuickJS 执行 JavaScript,可能增加恶意代码攻击风险,建议用户谨慎升级。

Telegram 于 11 月 9 日推出的 Bot API 10.4 正式引入该功能。尽管官方提供了 QuickJS 沙盒及网络访问限制,但近期安全研究人员发现,相关执行引擎曾存在可能突破沙盒隔离的远程代码执行漏洞。

解读
app_icon
ChainCatcher 与创新者共建Web3世界