#telegram-desktop

0 stories this week · 0 this month · 5 in 6 months · mostly security

Stories per day · 30 days

5 stories, newest first · one card per story

Telegram Desktop through 7.2.8 let a clicked link steal local login files.

Public PoC shows Telegram Desktop before 7.2.9 can leak local files and sessions via a crafted link.

GBHackersSep 15, 2026high

Stored XSS in Telegram Desktop HTML chat exports (CVSS 8.2) could let attacker-controlled inline keyboard buttons steal full chat histories.

ExPatch disclosed stored XSS in Telegram Desktop HTML export letting bot messages steal chat data when exports open in browsers.

Telegram Desktop HTML export XSS (CVSS 8.2) let bot messages exfiltrate exported chats; fixed in 7.0.1 but old exports stay vulnerable.

Stories tagged #telegram-desktop