Telegram Desktop Flaw Lets Hidden JavaScript Exfiltrate Messages From HTML Exports
A vulnerability in Telegram Desktop allowed a bot to inject hidden JavaScript into exported HTML chats, enabling an attacker to steal message content, modify chat data, and even impersonate Telegram with a fake verification form. The flaw was addressed in July, but older exports remain vulnerable. Telegram initially declined to disclose the issue publicly, citing concerns about exposing users to further risk, but ultimately published a fix and a bug bounty offer.
A flaw in Telegram Desktop allowed a bot to inject hidden JavaScript into exported HTML chats, enabling an attacker to steal message content, modify chat data, and even impersonate Telegram with a fake verification form. The vulnerability stemmed from the way Telegram Desktop handled HTML exports, specifically when bots were involved. The export code didn't properly escape characters, allowing a malicious bot to embed a script tag within a button's text, disguised as an empty button. This script could then read every message in the exported chat, including sender names and timestamps, the chat's name, type, and member count, and the local file path, and send them all to the attacker's server. Furthermore, the script could rewrite the page, replacing the entire export with a fake Telegram "verification" form.
Telegram Desktop's export code splits long exports into files of 1,000 messages each, so one file exposes at most its own contents, not the whole chat or the Telegram account. The vulnerability was addressed in July with a fix (commit 8457d13a) that added the missing escaping. The fix was released in the 6.9.4 beta on July 3 and the 7.0.1 stable release on July 14. Telegram initially declined to disclose the issue publicly, citing concerns about exposing users to further risk, offering a $500 bug bounty for the report, but ultimately published a fix and a bug bounty offer.
Telegram Desktop 4.15.1 (March 2024) through 6.9.3 were affected, while 6.9.4 beta (July 3, 2026), 7.0.1 (July 14, 2026) and later versions are fixed. Users are advised to update to 7.0.1 or later, or to 6.9.4 or later on the beta channel. If users have exported chats before the fix, they should open the old files only with JavaScript disabled and treat any HTML export made before the fix as untrusted, especially one from a large group where the origin of each message is hard to check. Telegram had not published any guidance for users holding older exports as of September 14. No CVE identifier was assigned to the vulnerability.