Telegram Desktop Flaw Lets Hidden JavaScript Exfiltrate Messages From HTML Exports
Telegram Desktop's HTML export feature contained a stored cross-site scripting (XSS) vulnerability where bot inline keyboard button text was written directly into exported HTML without proper escaping, allowing script injection A malicious bot could embed JavaScript in button labels that remained invisible in-chat but executed automatically when users opened exported HTML files in browsers, exfiltrating all messages to attacker-controlled servers The vulnerability existed for approximately two y
Analysis
TL;DR
- Telegram Desktop's HTML export feature contained a stored cross-site scripting (XSS) vulnerability where bot inline keyboard button text was written directly into exported HTML without proper escaping, allowing script injection
- A malicious bot could embed JavaScript in button labels that remained invisible in-chat but executed automatically when users opened exported HTML files in browsers, exfiltrating all messages to attacker-controlled servers
- The vulnerability existed for approximately two years and four months (since March 2024) across Telegram Desktop versions 4.15.1 through 6.9.3 before being patched in July 2026
- Old HTML exports created with vulnerable versions remain compromised even after updating the application, as the fix only prevents future injections but cannot remediate already-exported files
Why It Matters
This vulnerability demonstrates how a seemingly innocuous export feature in a widely-used messaging platform can become an attack vector for mass data exfiltration, affecting millions of Telegram Desktop users who regularly export chat histories for archival or legal purposes. The two-year exposure window and the fact that old exports remain vulnerable even after patching highlights the persistent risks of stored XSS in user-generated content pipelines, serving as a cautionary case study for any platform offering data export functionality.
Technical Details
- Vulnerability Type: Stored Cross-Site Scripting (XSS) via unescaped inline keyboard button text in HTML exports, rated 8.2/10 on CVSS 3.1 scale
- Attack Vector: Bots could embed
<script>tags in inline keyboard button labels, padded with invisible characters to appear empty in the Telegram Desktop client; the script executed automatically upon opening the exported HTML file in any browser with JavaScript enabled - Data Exfiltration Scope: The malicious script could read all messages (including sender names, timestamps, chat metadata, and local file paths) from exported HTML files containing up to 1,000 messages per file, then transmit them to attacker-controlled servers; it could also rewrite page content to display fake Telegram verification forms for phishing
- Exploitation Conditions: Three conditions required: (1) HTML export created with vulnerable Telegram Desktop version before the fix, (2) the injected message existed within the exported chat, and (3) the file was opened in a browser with JavaScript enabled; notably, the bot did not need to be a member of the target chat since link-button messages survive forwarding
- Patch Details: Fix commit 8457d13a by developer John Preston added proper HTML escaping to the export code; deployed in version 6.9.4 beta (July 3, 2026) and 7.0.1 stable (July 14, 2026); no CVE assigned and no security advisory published by Telegram
Industry Insight
- Export Feature Security Audits: Any platform offering data export functionality should treat exported files as untrusted surfaces requiring the same security scrutiny as user-facing interfaces; HTML exports with embedded interactive content are particularly risky and should implement strict Content Security Policies or sanitize all user-controlled fields
- Patch Lifecycle Management: The two-year gap between vulnerability introduction and patching, combined with Telegram's failure to publish a security advisory or CVE, underscores the importance of independent security research and responsible disclosure frameworks; organizations should proactively audit their export pipelines rather than relying solely on vendor security communications
- Legacy Data Remediation: The finding that old exports remain permanently compromised even after application updates creates a persistent attack surface; security teams should implement data retention policies that require re-exporting historical data after security patches, or treat all legacy exports as potentially malicious and restrict their opening to sandboxed environments with JavaScript disabled
Disclaimer: The above content is generated by AI and is for reference only.