Telegram Desktop Flaw Could Turn Old Chat Exports Into Data Theft Traps
ExPatch disclosed stored XSS in Telegram Desktop HTML export letting bot messages steal chat data when exports open in browsers.
ExPatch researchers Denis and Aleksander Rostilov found a stored XSS flaw (CVSS 8.2) where bot inline keyboard button text was written unescaped into HTML chat exports, executing attacker JavaScript in browsers. The payload can persist in chat history for months, exfiltrate messages, metadata, and local file paths, and rewrite the page, spreading via forwarded messages without bot membership. Telegram fixed it by applying SerializeString(), first stable fixed release 7.0.1 shipped July 14, 2026, but HTML exports created with vulnerable versions remain dangerous.
- Unescaped inline keyboard button text enabled script injection in HTML exports
- Payload persists months and triggers when export opens in browser, no second click
- Injected JavaScript can exfiltrate messages, metadata, and local file paths
- Flaw present since stable 4.15.1 (March 2024); fixed in 7.0.1
- Updating Telegram Desktop does not sanitize already-exported malicious HTML files
From the original article
5 min read at securityaffairs.com
A Telegram Desktop flaw let bots inject JavaScript into exported chats, enabling data theft and page manipulation. Old HTML exports remain unsafe. A vulnerability in Telegram Desktop could have turned an ordinary chat export into a serious data leak.
By Pierluigi Paganini · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.