Security researchers from ExPatch have uncovered a significant vulnerability in Telegram Desktop, allowing malicious JavaScript to be embedded in chat exports saved as HTML files. This flaw, identified on September 12, allowed attackers to exfiltrate messages and modify exported chat data when opened in a web browser.
Vulnerability Details and Impact
The vulnerability was present in Telegram Desktop versions 4.15.1 through 6.9.3 on Windows, macOS, and Linux platforms. It allowed a bot to insert hidden JavaScript within a message’s inline button, which was then directly embedded into exported HTML files without proper character escaping. Upon opening these files in a browser, the script could transmit chat data to an unauthorized server or manipulate the content displayed.
Although Telegram released a fix in July, earlier exports remain vulnerable if they were created before the update. Consequently, users need to be cautious with older HTML exports, as they can still harbor malicious scripts.
Telegram’s Response and Fix Implementation
Telegram addressed the issue swiftly after being informed on June 3, with a fix implemented in Telegram Desktop version 7.0.1 on July 14, 2026. The fix, developed by John Preston, involves adding the necessary escaping for button text to prevent JavaScript execution. Despite the update, Telegram has not issued public advisories or a CVE identifier for this flaw.
Users are advised to update to the latest version of Telegram Desktop and re-export any chats previously saved as HTML. If using older exports, disabling JavaScript in the browser is recommended to prevent unauthorized script execution.
Recommendations for Users
The researchers suggest treating any HTML export made before the update as potentially untrustworthy, especially if originating from large group chats where message origins are unclear. As of September 14, no official guidance from Telegram has been provided for managing older exports.
Additionally, the researchers have declined a $500 bug bounty offered by Telegram, requesting it be donated to charity instead. Their publication of the vulnerability aimed to raise awareness without jeopardizing user security, given the lack of a non-disclosure agreement.
In summary, users are encouraged to ensure their Telegram Desktop application is updated to the latest version to safeguard against this vulnerability. By following these recommendations, users can protect their chat data from potential exploitation.
