A critical vulnerability in Telegram Desktop has been identified, allowing attackers to embed malicious JavaScript within bot-generated inline keyboard buttons. This flaw posed a risk to user data when chat histories were exported as HTML files.
Security Flaw and Resolution
The vulnerability was addressed in Telegram Desktop Beta 6.9.4 and Stable 7.0.1. However, HTML exports created with earlier versions may still be at risk. Security experts Denis and Aleksander Rostilov from ExPatch discovered the issue, which originated from the way text in inline keyboard buttons was processed in exported HTML files.
Telegram Desktop facilitates the export of individual chat threads or entire account histories into HTML documents for purposes such as archiving and compliance. Prior to the patch, these exports incorporated button text without adequate character escaping, enabling attackers to embed harmful HTML scripts.
Mechanics of the Exploit
The exploitation required several conditions: the presence of a malicious message in the chat history, use of a vulnerable Telegram Desktop version for export, and opening the exported HTML file in a browser with JavaScript enabled. Upon opening, the script could access and extract sensitive chat information such as messages, sender details, and timestamps.
Attackers could also manipulate visible content or redirect users to phishing sites by modifying the export page’s appearance. The flaw enabled attackers to implant dormant payloads in group chats, activating only when the HTML file was exported and opened, posing risks to compliance and legal processes.
Recommendations and Future Steps
Telegram has implemented a fix in commit 8457d13a, ensuring proper HTML escaping for inline button text. The fix is available from Telegram Desktop Beta 6.9.4 and Stable 7.0.1 onwards. Users are urged to upgrade to these versions or later to mitigate risks.
Organizations should audit and replace previous HTML exports from vulnerable versions, as these remain susceptible to exploitation. Treat legacy Telegram HTML files as potentially harmful, opening them only with JavaScript disabled, or regenerate them using a secure version.
This incident underscores the importance of regular software updates and vigilant cybersecurity practices to protect sensitive communications from evolving threats.
