A high-severity Telegram Desktop vulnerability let attackers hide JavaScript in bot-created inline keyboard buttons and steal chat content when victims exported conversations as HTML files.
Telegram fixed the issue in Desktop Beta 6.9.4 and Stable 7.0.1, but HTML exports created with older versions may remain unsafe.
Security researchers Denis Rostilov and Aleksander Rostilov of ExPatch discovered the stored cross-site scripting flaw in Telegram Desktop’s HTML export feature. The bug affected the way the application handled text displayed inside inline keyboard buttons attached to bot messages.
Telegram Desktop can export individual chats or full account histories as HTML files. Users can then open these files locally in a web browser for archiving, compliance, legal, or backup purposes.
Before the patch, the export function inserted inline keyboard button text directly into the generated HTML document without properly escaping special characters.
This meant an attacker could create a bot message containing malicious HTML, including a script tag, inside the button label. The payload could be concealed with invisible Unicode characters, allowing the button to look blank or harmless in the Telegram client.
Telegram Desktop Flaw
Telegram’s desktop interface displayed the content as plain text. However, a web browser interpreted the same content as executable markup when the exported HTML file was opened.
The attack did not execute simply because a victim received or viewed the Telegram message. Instead, exploitation required several conditions: a malicious message had to be present in chat history, the victim needed to export that chat from a vulnerable Telegram Desktop version, and the exported HTML file had to be opened with JavaScript enabled.
Once opened, the hidden script could access data rendered inside the export page. This could include chat messages, sender names, timestamps, group names, message metadata, and the full visible text of the conversation. Researchers said an attacker could send this information to an external server or alter the page the victim sees.
The flaw was especially concerning because a malicious bot did not need to be a member of the target group. An attacker could send a crafted bot message to another user and rely on that message being forwarded into a private group, public group, or supergroup.
Telegram preserves certain URL-based inline keyboard buttons during forwarding, allowing the malicious button text to remain embedded in the forwarded message.
As a result, the payload could remain dormant in a group’s history for months. It would activate only when someone later exported the chat and opened the HTML archive. This creates a delayed attack path that could affect compliance reviews, internal investigations, or legal evidence collection workflows.
The researchers also demonstrated that the injected code could replace the export page with a fake Telegram verification screen. Such DOM manipulation could be used for credential phishing or for altering the visible presentation of chat records.
The attack does not modify Telegram’s server-side messages. However, it can manipulate what a user sees in the browser-based export.
Telegram addressed the flaw in commit 8457d13a, which applies HTML escaping to inline keyboard button text.
According to ExPatch, the fix was released in Telegram Desktop Beta 6.9.4 on July 3, 2026, and Stable 7.0.1 on July 14, 2026. The vulnerable code had reportedly existed since Telegram Desktop 4.15.1, released in March 2024.
Users should update Telegram Desktop to version 7.0.1 or later. Organizations should also identify and replace older HTML chat exports because updating the application does not sanitize files already created.
Treat old Telegram HTML exports as potentially active content, and open them only with JavaScript disabled or regenerate them using a patched version.
Learn 7 Metric-Gated AI SOC Deployment Phases – Download Free AI SOC Deployment Playbook 2026.
The post Telegram Desktop Flaw Lets Attackers Steal Chat Messages Through Poisoned HTML Exports appeared first on Cyber Security News.