Telegram Desktop XSS Vulnerability Lets Attackers Steal Entire Chat Histories
Stored XSS in Telegram Desktop HTML chat exports (CVSS 8.2) could let attacker-controlled inline keyboard buttons steal full chat histories.
ExPatch researchers Denis and Aleksander Rostilov found a stored XSS in Telegram Desktop's HTML chat export pipeline affecting builds before Beta 6.9.4 and Stable 7.0.1. Unsanitized inline keyboard button text becomes executable JavaScript when a user exports a chat and opens the HTML file in a browser, exposing messages, metadata, and local file paths, and enabling phishing overlays. Telegram patched the issue in commit 8457d13a during July 2026; no CVE had been assigned at disclosure time.
- CVSS 3.1 score 8.2 (High); affects Telegram Desktop before Beta 6.9.4 and Stable 7.0.1
- Malicious inline button text skipped SerializeString() escaping in HTML export
- Poisoned buttons can persist in forwarded group messages for months before export
- Patch also fixes separate JavaScript injection in copy-callback onclick handlers
- No exploitation reported; pre-patch HTML exports should be treated as unsafe
From the original article
3 min read at gbhackers.com
A stored cross-site scripting (XSS) vulnerability in Telegram Desktop could enable attackers to steal the contents of exported chat histories by embedding malicious code in an inline keyboard button, according to security researchers. This issue affects the HTML chat export feature in Telegram Desktop builds released before Beta version 6. 9.
By Divya · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.