Interactive web messages right in the chat

The TBetaLeak channel discovered a large experimental subsystem called HTMLBubbles in version 12.10.283300 of Telegram for macOS.

According to the description, the messaging app is testing interactive messages built with HTML, CSS, and JavaScript right in the chat, without the need to launch a separate Web Mini App window.

@tginfo editors have confirmed the module’s presence in the code of that version based on a preliminary review, but the described behavior and how it works have not yet been independently verified.

The idea is to turn ordinary messages into widgets: product cards with selectable options, interactive boarding passes, or live charts.

According to the source, rendering is handled by the compact litehtml engine, while scripts run in a heavily restricted sandbox with CPU limits, network requests blocked, and external media prohibited. You can read all the technical details about these restrictions in the source post.

Editors’ concerns

Despite the extensive list of restrictions, @tginfo editors have serious security concerns about this kind of feature. Integrating web engines that support JavaScript execution — even in a heavily restricted form — directly into the chat interface poses a huge risk.

Experience shows that no matter how thoroughly developers isolate an environment, vulnerabilities are regularly found in rendering systems. The risk of malicious code running simply by viewing a chat raises serious questions about whether these widgets are worth it.

For now, HTMLBubbles is an early experimental concept being tested within the Telegram team. The feature could change substantially during development or be canceled entirely.

#macOS #beta