Telegram Desktop Flaw Let Hidden JavaScript Steal Exported Chat Data

Security researchers Denis Rostilov and Aleksander Rostilov of ExPatch disclosed a high-severity vulnerability in Telegram Desktop that allowed attackers to embed hidden JavaScript inside chat messages, exfiltrating data from HTML exports opened in any web browser. The flaw, rated 8.2 out of 10 on the CVSS 3.1 scale, stemmed from Telegram's export function failing to sanitize inline keyboard button text — content generated by bots and rendered into standalone HTML pages. A bot could plant a script tag disguised with invisible zero-width characters inside a button label, making the button appear blank in the chat client while carrying executable code that would trigger the moment a user opened the exported file.

The attack chain was particularly insidious because it required no interaction beyond opening the export. Any bot could craft a malicious message, and because Telegram preserves web-link buttons during message forwarding, an unsuspecting group member could carry the payload into an unrelated chat simply by forwarding it. The payload would then persist in the chat history indefinitely until deleted, ready to activate months or years later when someone exported and reviewed the conversation. Once triggered, the script could read every message in the exported file — including sender names, timestamps, chat metadata, and the local file path — and transmit everything to an attacker-controlled server. Attackers could also rewrite the rendered page to display fraudulent content, such as a fake Telegram verification form designed to harvest credentials.

Telegram shipped a fix in July after the researchers reported the flaw on June 3, but the patch does not retroactively clean up HTML files generated by earlier versions of the desktop client. Because Telegram Desktop splits large exports into 1,000-message segments, each compromised file exposes only its own contents rather than an entire account, limiting the blast radius. Still, the researchers noted that exported chats are frequently used as long-term records in legal, journalistic, and enterprise contexts, where silently altered timestamps or message text could have serious downstream consequences. Users concerned about exposure can verify their browser's resistance to similar DOM-based attacks with a browser fingerprint test, while those reviewing the integrity of their own communications infrastructure should run a DNS leak test to confirm no covert data channels are active on their network. For a broader review of digital exposure, the privacy checkup tool provides a comprehensive assessment across common attack surfaces.