A vulnerability in Telegram Desktop could allow specially crafted bot messages to execute JavaScript inside HTML chat exports, potentially exposing the messages and metadata contained in those files.
The flaw was fixed in July, roughly two months before its public disclosure, but HTML exports created with older vulnerable versions may remain dangerous even after Telegram Desktop is updated.
Security researchers Denis Rostilov and Aleksander Rostilov of ExPatch Vulnerability Research discovered the issue on June 1, 2026, while examining Telegram Desktop’s HTML export feature. They reported it to Telegram two days later, along with proof-of-concept demonstrations.
The vulnerability affected Telegram Desktop, the official desktop client for Telegram, one of the world’s largest messaging services. Specifically, it involved the feature that allows users to export conversations as HTML files for viewing in a web browser.
According to the researchers, Telegram Desktop failed to properly sanitize the text displayed inside inline keyboard buttons when generating those HTML files. While ordinary message content and other fields were escaped before being written to the export, button text was inserted directly into the document.
An attacker could therefore create a bot message containing a hidden ‘script’ element inside a button. The message would appear largely normal inside Telegram because the application itself does not interpret the button text as HTML.
The unusual aspect of the attack is that the malicious bot does not necessarily need to belong to the targeted group or have permission to read its messages.
An attacker could send the prepared message elsewhere and have another user forward it into a target conversation. Telegram preserves certain inline buttons when messages are forwarded, allowing the malicious content to remain dormant in the chat history.
ExPatch
Exploitation, however, requires several additional steps. A victim must create an HTML export using a vulnerable Telegram Desktop version, the malicious message must be included in that export, and the victim must then open the resulting file in a browser.
At that point, the embedded JavaScript could execute and access information displayed on the page, including exported messages, sender names, timestamps, and chat metadata. The researchers also demonstrated that the script could alter the document's appearance, potentially replacing the exported conversation with a phishing page or modifying how chat history is presented.
This makes the flaw a potentially high-impact stored cross-site scripting (XSS) issue, but not one that can compromise users merely by receiving or viewing a Telegram message.
Telegram fixed the vulnerable code in commit 8457d13a by applying the same HTML sanitization already used elsewhere in the export process. The researchers say the fix first appeared in Telegram Desktop Beta 6.9.4 on July 3 and stable version 7.0.1 on July 14.
No CVE had been assigned as of September 11, and the researchers said Telegram had not published a dedicated security advisory.
Users should run Telegram Desktop 7.0.1 or later. More importantly, anyone with HTML chat exports created using an older version should consider deleting and recreating them after updating, since previously generated files are not automatically repaired and could still contain dormant malicious code.
Leave a Reply