Telegram Desktop XSS Flaw Lets Attackers Hide JavaScript in HTML Chat Exports

A flaw in Telegram Desktop could enable attackers to hide JavaScript inside messages that users later saved as HTML. ExPatch security researchers Denis Rostilov and Aleksander Rostilov found the flaw in the app’s HTML export feature. They disclosed their findings on September 12, after Telegram had already fixed the issue.

The bug let a bot put hidden code inside the text of an inline keyboard button. The message could look normal inside Telegram. The danger appeared later. If a user exported a chat with a vulnerable Telegram Desktop version, the hidden script could run when the user opened the HTML file in a browser.

The researchers said the code could read messages in that export and send them to an attacker-controlled server. It could also change what the victim saw on the page. There is no evidence that attackers used the flaw against real users. ExPatch said it tested the issue only with its own accounts and test groups.

The Problem was in Telegram’s Export Code

Users could export chats from Telegram Desktop in HTML format that can be opened in a browser. The app’s own documentation describes this HTML export. It also says users can open the resulting file in a web browser.

The export process escaped message text, sender names, and several other fields. That stops characters such as < from acting as HTML code.

But researchers found a gap in the handling of inline keyboard button text. Telegram’s export code wrote that text into the HTML without the same protection. A bot could then place HTML and JavaScript code inside a button’s text.

The researchers used invisible Unicode characters to make the malicious button look empty in the Telegram Desktop version they tested.

This mattered because Telegram did not treat the button text as HTML inside the app. A browser did when it opened the exported file. The result was a stored cross-site scripting, otherwise known as XSS, vulnerability.

A Forwarded Message could Spread the Payload

The attack did not require the malicious bot to join the victim’s group. ExPatch found that some bot messages with URL-only inline keyboards kept their buttons when users forwarded them. A member could therefore forward the poisoned message into another group.

The malicious content could then sit in that group’s history. Someone might export the chat months later without knowing that an old message carried executable code. When a victim opened the poisoned HTML file in a browser with JavaScript enabled, the script could run without another click.

The researchers said the script could collect messages shown in the export, plus sender names and timestamps. It could also collect the chat name, chat type and member count. The script could expose the local file path too.

Telegram Desktop splits large HTML exports into files with up to 1,000 messages. That limits the exposed data to the affected export file, rather than the whole account.

The Page Could Also Show Fake Content

The flaw did more than allow silent data theft. The injected JavaScript could control the HTML page and change what the victim saw.

In their demonstration, the researchers replaced the exported conversation with a fake Telegram verification page. They also showed that the script could change visible message details. That creates a risk for people who use chat exports as records.

An attacker could change visible dates, sender names, or message text in the browser. Those changes would not alter Telegram’s copy of the chat. They also would not change the saved HTML file on disk.

Telegram Fixed the Bug in July

ExPatch reported the vulnerability to Telegram on June 3, 2026. Telegram changed the export code so button text now gets the same escaping as other HTML content. Telegram fixed the flaw in commit 8457d13a. Beta users actually got the update first in v 6.9.4, around July 3. Then, about ten days later, it became available to everyone else in stable version 7.0.1.

Interestingly, ExPatch says the buggy code has been in stable releases since version 4.15.1, and that’s since March 2024.  Meaning the vulnerability’s been there for more than two years.

Researchers assigned it an 8.2 CVSS score. This is their own evaluation, though.  It’s not an official score from Telegram or the NVD. The score reflects the possible data exposure and the steps a victim must take before the script can run.

Old Exports Remain the Bigger Concern

Updating Telegram Desktop fixes new HTML exports. It does not clean files that users created before the patch. That leaves old exports as the main concern. ExPatch recommends making new HTML exports after updating Telegram Desktop. Users who need an older file should open it with JavaScript disabled.

Users should also treat old HTML exports as untrusted files. That matters most for exports from large groups, where users may not know every message sender. Telegram users have also faced separate concerns over alleged data exposure. In another recent case, a massive Telegram data breach claim emerged online, although its authenticity remained unverified.

Telegram’s public bug-bounty rules say it does not reward flaws that researchers disclose before a fix. The rules do not say that researchers need approval to publish details after a fix.

ExPatch said Telegram confirmed the issue and offered a $500 bounty. The researchers declined the money and asked Telegram to give it to charity. Telegram also asked the researchers to delay public disclosure, according to an email they published. ExPatch later published its report after the July fix.

As of September 14, Telegram has yet to release any security advisory regarding this issue or even assign it a CVE. The public release notes by Telegram provided no explanation about the security fix.

The researchers did not test Telegram’s JSON export or export features in other Telegram apps. Their findings focus on Telegram Desktop’s HTML export.

For users, the safest step is simple: update Telegram Desktop to 7.0.1 or later. Then recreate any HTML exports made before the fix. Avoid opening old exports with JavaScript enabled.