Researchers Disclose Zero-Click Flaw in Telegram Emoji Stickers Enabling Code Execution on iOS

October 28 — Researchers at a security conference held in Tokyo disclosed a zero-click vulnerability in Telegram's emoji sticker feature and demonstrated that an attacker could execute code on iOS devices without any user interaction. However, Telegram disputes the risk assessment of the vulnerability, and the available information does not yet specify the exact scope of impact or the status of remediation.

Note: A zero-click vulnerability is a high-severity flaw that an attacker can trigger without the user clicking, opening, or executing anything — the device merely has to automatically process malicious data. Common entry points include voice calls, message previews, web page rendering, audio decoding, and wireless debugging.