TENET: Telegram Mini App (in)security

• URL: http://arxiv.org/abs/2608.17538v1
• Date: Tue, 18 Aug 2026 08:59:03 GMT
• Title: TENET: Telegram Mini App (in)security
• Abstract summary: Many Mini Apps store authentication materials, exposing users to unauthorized access, impersonation, and financial exploitation.<n>We present TENET, a purpose-built auditing tool whose design decisions are grounded in the structural properties of the secrets targeted.<n>We propose mitigation measures and best practices for both Telegram platform developers and third-party Mini App creators.
• Score: 2.1793134762413433
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: Telegram, with over 450 million daily active users, has introduced Mini Apps---web-based applications running directly within its client. However, this integration introduces notable security risks. As we demonstrate, many Mini Apps store authentication materials---such as session tokens and wallet mnemonic phrases---in plaintext on client devices, exposing users to unauthorized access, impersonation, and financial exploitation. While insecure client-side storage is a known risk in web applications, the Telegram Mini App ecosystem presents a uniquely dangerous combination of factors absent from prior work: no platform-level security review, no storage access restrictions, a financially motivated user base handling live cryptocurrency assets, and a WebView environment that offers weaker protections than standalone browsers. To investigate this threat, we present TENET, a purpose-built auditing tool whose design decisions---pattern selection, entropy thresholds, and charset validation---are grounded in the structural properties of the secrets targeted and empirically validated against a ground-truth dataset. We screened 61 Mini Apps using a stratified, popularity-weighted sampling strategy based on popularity. Of the 37 applications that met our processing criteria and were analyzed, 30 exhibited security flaws, which we classify into three severity tiers: plaintext storage, recoverable encryption, and replayable tokens. Notably, even Telegram's official Wallet exhibits a severe vulnerability that may lead to full account compromise. Following our responsible disclosure, Telegram implemented two new secure-storage APIs, and our post-remediation verification confirmed that its official Wallet no longer exposes the recovery mnemonic in plaintext. Finally, we propose mitigation measures and best practices for both Telegram platform developers and third-party Mini App creators.

Related papers

• Don't Trust the Super-App: A Case Study of Russia's Max [6.434185166424619]
  Super-apps host third-party mini-apps inside a single app.<n>We show how malicious super-apps have undeniable capabilities to silently undermine the security and privacy of mini-apps.
  arXiv  Detail & Related papers  (2026-09-10T17:08:00Z)
• TeleGapper: On the (un)reliability of Privacy Policies in Telegram Mini apps [3.345437353879255]
  Telegram Mini Apps are Web applications embedded within the Telegram client.<n>Despite their growing adoption and access to Telegram-provided context, their privacy properties remain largely unexplored.<n>We present TeleGapper, a black-box dynamic analysis framework to assess the privacy posture of Mini Apps.
  arXiv  Detail & Related papers  (2026-08-13T15:51:18Z)
• Stealing Reasoning Traces from Proprietary LLM APIs [84.58379404903394]
  We develop a scalable decryption jailbreak for encrypted reasoning traces.<n>It circumvents anti-distillation mechanisms, allowing adversaries to extract a proprietary model's reasoning.<n>It inadvertently reveals hazardous information hidden within the reasoning process.
  arXiv  Detail & Related papers  (2026-08-10T17:24:50Z)
• Bag of Tricks for Subverting Reasoning-based Safety Guardrails [62.139297207938036]
  We present a bag of jailbreak methods that subvert the reasoning-based guardrails.<n>Our attacks span white-, gray-, and black-box settings and range from effortless template manipulations to fully automated optimization.
  arXiv  Detail & Related papers  (2025-10-13T16:16:44Z)
• Synopsis: Secure and private trend inference from encrypted semantic embeddings [2.7998963147546148]
  We introduce Synopsis, a secure architecture for analyzing messaging trends in consensually-donated E2EE messages using message embeddings.<n>Since the goal of this system is investigative journalism, Synopsis must facilitate both exploratory and targeted analyses.<n> Evaluations on a dataset of Hindi-language WhatsApp messages demonstrate the efficiency and accuracy of our approach.
  arXiv  Detail & Related papers  (2025-05-29T17:34:10Z)
• Layer-Level Self-Exposure and Patch: Affirmative Token Mitigation for Jailbreak Attack Defense [55.77152277982117]
  We introduce Layer-AdvPatcher, a methodology designed to defend against jailbreak attacks.<n>We use an unlearning strategy to patch specific layers within large language models through self-augmented datasets.<n>Our framework reduces the harmfulness and attack success rate of jailbreak attacks.
  arXiv  Detail & Related papers  (2025-01-05T19:06:03Z)
• Beyond App Markets: Demystifying Underground Mobile App Distribution Via Telegram [23.638100691705482]
  This study provides the first comprehensive exploration of the underground mobile app ecosystem on Telegram. Our findings reveal the significant prevalence of these apps on Telegram, with the total sum of subscription user numbers promoting these apps equivalent to 1% of Telegram's user base. Our analysis also exposes the misuse of iOS features for app distribution and the prevalence of malicious behaviors in these apps.
  arXiv  Detail & Related papers  (2024-08-06T23:55:39Z)
• Non-Fungible Programs: Private Full-Stack Applications for Web3 [0.3683202928838613]
  This paper introduces the Non-Fungible Program (NFP) model for developing self-contained applications. NFP applications are distributed blockchain, powered by Web technology, and backed by private databases in smart contracts. Access to code, as well as backend services, is controlled and guaranteed by smart contracts according to the NFT ownership model.
  arXiv  Detail & Related papers  (2024-04-24T03:46:18Z)
• VELLET: Verifiable Embedded Wallet for Securing Authenticity and Integrity [0.6144680854063939]
  This paper proposes a new protocol to enhance the security of embedded wallets. Our VELLET protocol introduces a wallet verifier that can match the audit trail of embedded wallets on smart contracts.
  arXiv  Detail & Related papers  (2024-04-05T03:23:19Z)
• CodeChameleon: Personalized Encryption Framework for Jailbreaking Large Language Models [49.60006012946767]
  We propose CodeChameleon, a novel jailbreak framework based on personalized encryption tactics. We conduct extensive experiments on 7 Large Language Models, achieving state-of-the-art average Attack Success Rate (ASR) Remarkably, our method achieves an 86.6% ASR on GPT-4-1106.
  arXiv  Detail & Related papers  (2024-02-26T16:35:59Z)
• Backdoor Attack against Speaker Verification [86.43395230456339]
  We show that it is possible to inject the hidden backdoor for infecting speaker verification models by poisoning the training data. We also demonstrate that existing backdoor attacks cannot be directly adopted in attacking speaker verification.
  arXiv  Detail & Related papers  (2020-10-22T11:10:08Z)
• Mind the GAP: Security & Privacy Risks of Contact Tracing Apps [75.7995398006171]
  Google and Apple have jointly provided an API for exposure notification in order to implement decentralized contract tracing apps using Bluetooth Low Energy. We demonstrate that in real-world scenarios the GAP design is vulnerable to (i) profiling and possibly de-anonymizing persons, and (ii) relay-based wormhole attacks that basically can generate fake contacts.
  arXiv  Detail & Related papers  (2020-06-10T16:05:05Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.