Stored XSS in Telegram Desktop's HTML export: a bot that never joins your group plants invisible JavaScript in an inline keyboard button; the payload detonates when a participant opens the exported file. Fixed in v6.9.4/v7.0.1; CVE-2026-94488. Analysis by ExPatch research.

Stored XSS in Telegram Desktop's HTML export: a bot that never joins your group plants invisible JavaScript in an inline keyboard button; the payload detonates when a participant opens the exported…

Telegram Desktop fixed a flaw that let bot messages embed JavaScript in HTML exports to read or alter messages; old exports remain affected.

A flaw in Telegram Desktop let a bot's message plant hidden JavaScript inside chats that users exported to HTML files, security researchers at ExPatch said in a writeup published on September 12. In Telegram, the message looked ordinary, with a link button, and the script ran only when someone opened the export file in a web browser. It could then copy every message in that file to

A flaw in Telegram Desktop let a bot's message plant hidden JavaScript inside chats that users exported to HTML files, security researchers at ExPatch said in a writeup published on September 12. In Telegram, the message looked ordinary, with a link button, and the script ran only when someone opened the export file in a web browser. It could then copy every message in that file to

A Telegram Desktop flaw let bots inject JavaScript into exported chats, enabling data theft and page manipulation. Old HTML exports remain unsafe. A vulnerability in Telegram Desktop could have turned an ordinary chat export into a serious data leak. Security researchers Denis and Aleksander Rostilov of ExPatch found a stored cross-site scripting flaw in the […]

A flaw in Telegram Desktop allowed a bot's message to plant hidden JavaScript inside chats that executed when users exported conversations to HTML files and opened them in a web browser. Security researchers at ExPatch disclosed the vulnerability in a writeup published on September 12. In Telegram, the malicious message appeared ordinary with a link button, but the embedded script could copy every message in the exported file once opened in a browser. The JavaScript remained hidden within the chat export and only activated upon opening the HTML file.

A flaw in Telegram Desktop let a bot's message plant hidden JavaScript inside chats that users exported to HTML files, security researchers at ExPatch said in a writeup published on September 12. In Telegram, the message looked ordinary, with a link button, and the script ran only when someone opened the export file in a web browser. It could then copy every message in that file to

Een ernstige beveiligingskwetsbaarheid in Telegram Desktop stelde aanvallers in staat om gevoelige informatie uit chats te stelen wanneer gebruikers hun gesprekken exporteerden als HTML-bestanden. De kwetsbaarheid, ontdekt door onderzoekers Denis en Aleksander Rostilov van ExPatch, was van het type stored cross-site scripting (XSS) en betrof de manier waarop de applicatie tekst in knoppen van door bots aangemaakte inline toetsenborden verwerkte. Aanvallers konden schadelijke JavaScript-code verbergen in de labels van deze knoppen. Door gebruik te maken van onzichtbare Unicode-tekens kon deze payload erin slagen om de knop in de Telegram-client leeg of onschadelijk te laten lijken, terwijl d...