Telegram Desktop Flaw Lets Attackers Steal Chat Messages Through Poisoned HTML Exports
Telegram Desktop XSS in bot inline keyboard buttons let attackers steal chat content from exported HTML archives; patched in 7.0.1.
ExPatch researchers Denis and Aleksander Rostilov found a stored cross-site scripting flaw in Telegram Desktop's HTML export feature, present since version 4.15.1 (March 2024). JavaScript hidden in bot inline keyboard button text executes when a user opens an exported chat HTML file with JavaScript enabled, exposing messages, metadata, and enabling DOM manipulation such as fake verification screens. Fixes shipped in Desktop Beta 6.9.4 (July 3, 2026) and Stable 7.0.1 (July 14, 2026), but previously exported HTML files remain unsafe.
- Stored XSS via unescaped bot button text in HTML chat exports
- Vulnerable since Telegram Desktop 4.15.1 (March 2024)
- Payload can lie dormant in forwarded group history for months
- Old exports stay unsafe after update; open only with JavaScript disabled
From the original article
3 min read at cybersecuritynews.com
A high-severity Telegram Desktop vulnerability let attackers hide JavaScript in bot-created inline keyboard buttons and steal chat content when victims exported conversations as HTML files. Telegram fixed the issue in Desktop Beta 6. 9.
By Abinaya · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.