International Conference on Computer and Knowledge Engineering

Home / 15th International Conference on Computer and Knowledge Engineering

Security Analysis of MiniApps: Vulnerabilities, Exploits, and a Tailored Mitigation Framework

Authors :

Keyhan Mohammadi¹ Arman Moradi² Reza Ebrahimi Atani³

1- Dept. of Computer Engineering University of Guilan Rasht, Iran 2- Dept. of Computer Engineering University of Guilan Rasht, Iran 3- Dept. of Computer Engineering University of Guilan Rasht, Iran

Keywords :

Telegram MiniApps،WebView Exploits،Man in the Middle Attacks،Data Leakage،Sandbox Isolation،Web3Auth

Abstract :

Telegram MiniApps and WeChat Mini Programs represent two leading implementations of the superApp sub application paradigm, each combining centralized backend ser- vices with lightweight, embedded client interfaces. While both platforms enable rich user experiences, they also introduce significant security risks through architectural and implemen- tation flaws. In this paper, we present a comparative analysis of vulnerabilities in Telegram MiniApps and WeChat Mini Programs, drawing from documented exploits and empirical testing. For WeChat, prior studies reveal widespread issues including sensitive data leakage, weak permission enforcement, and cross MiniApp request forgery, affecting millions of deployed apps. For Telegram, we identify unproxied frontend–backend communication leaking IPs and server endpoints, insecure HTTP defaults in the Bot API enabling man in the middle attacks, and inadequate auditing of TON blockchain smart contracts. We further analyze adversarial MiniApps exploiting WebView sandbox weaknesses for malware delivery, cryptomining, and cryptocurrency phishing. Building on these findings, we propose a comprehensive mitigation framework tailored to Telegram but informed by lessons from WeChat’s vulnerabilities. Our approach includes mandatory HTTPS, Telegram-hosted proxying, sandbox isolation, automated malicious activity detection, and AI-assisted code auditing. The results highlight the urgent need for platform level reforms across superApp ecosystems to align rapid feature growth with strong user privacy and security guarantees.

Papers List

List of archived papers

UAV-based Firefighting by Multi-agent Reinforcement Learning

Reza Shami Tanha - Mohsen Hooshmand - Mohsen Afsharchi

TriFuse-PdM: High-Fidelity Machine Failure Prediction Using Hybrid Resampling and Model Calibration

Saghar Shafaati - Javad Mohammadzadeh

Sports News Summarization Using Ensebmle Learning

Moein Sartakhti.salimi@gmail.com - Mohammad Javad Maleki Kahaki - Ahmad Yoosofan - Seyyed Vahid Moravvej

Prediction of West Texas Intermediate Crude-oil Price Using Hybrid Attention-based Deep Neural Networks: A Comparative Study

Alireza Jahandoost - Mahboobeh Houshmand - Seyyed Abed Hosseini

Extracting Major Topics of COVID-19 Related Tweets

Faezeh Azizi - Hamed Vahdat-Nejad - Hamideh Hajiabadi - Mohammad Hossein Khosravi

Optimizing the controller placement problem in SDN with uncertain parameters with robust optimization

Mohammad Kazemi - AhmadReza Montazerolghaem

Optimizing Question-Answering Framework Through Integration of Text Summarization Model and Third-Generation Generative Pre-Trained Transformer

Ervin Gubin Moung - Toh Sin Tong - Maisarah Mohd Sufian - Valentino Liaw - Ali Farzamnia - Farashazillah Yahya

Data-Optimized Dry Rock Property Prediction Using Ensemble and Kernel-Based ML Methods

Esmael Makarian - Hassanreza Ghasemitabar - Alireza Behinrad - Mahdi Fathi - Andisheh Alimoradi - Ayub Elyasi

FedBrain-Distill: Communication-Efficient Federated Brain Tumor Classification Using Ensemble Knowledge Distillation on Non-IID Data

Rasoul Jafari Gohari - Laya Aliahmadipour - Ezat Valipour

AI-Driven Relocation Tracking in Dynamic Kitchen Environments

Arash Nasr Esfahani - Hamed Hosseini - Mehdi Tale Masouleh - Ahmad Kalhor - Hedieh Sajedi