A security researcher presented at OffensiveCon Tokyo this week demonstrating how Telegram's animated sticker rendering library can be chained with server-side validation bypasses to achieve code execution on iOS. No tap, no link, no interaction required. Telegram's position remains that their server-side checks make this technically impossible. The vulnerable client-side code is still live in the app with no patch.