Telegram Desktop HTML Export Conceals XSS Vulnerability
A routine export of Telegram correspondence could inadvertently transform a saved chat history into a covert instrument for message theft. Security researchers uncovered a pernicious vulnerability residing within Telegram Desktop. This critical flaw permitted the stealthy injection of malicious JavaScript directly into HTML chat archives. Astonishingly, this error lingered within the client for approximately two years and four months. Consequently, files generated prior to the remediation may continue to pose a severe security threat, even after the Telegram application is updated.
The Mechanics of Stored XSS in Chat Archives
This specific security issue fundamentally belongs to the Stored Cross-Site Scripting (XSS) classification. Telegram Desktop possesses the functionality to save chat histories as HTML pages, which the user subsequently opens employing a standard web browser. During the file generation process, the application correctly escaped potentially hazardous characters within the message text, sender names, and various other fields. However, it critically failed to sanitize the text embedded within the inline keyboard buttons utilized by Telegram bots.
Due to this glaring oversight, the button string cascaded into the HTML output entirely devoid of necessary processing. A malicious bot could effortlessly embed a script tag directly into the button’s title, and Telegram Desktop would blindly record the contents as functional HTML markup. Crucially, the malicious code did not execute within the messenger application itself; both desktop and mobile clients render button text through their proprietary interfaces, refusing to interpret it as a web page. The genuine peril materialized later, specifically when the user exported the correspondence and subsequently opened the resulting file within a web browser.
Bot Delivery Without Group Membership
To successfully deliver the malicious payload, the offending bot did not even require membership within the targeted group. Because URL buttons persist during message forwarding, an attacker could meticulously prepare the compromised message and orchestrate its transmission into an unrelated, unsuspecting chat. Once safely lodged within the history, the malicious string could lie dormant for months or even years, remaining completely inactive until the precise moment of export.
Following the initialization of the compromised HTML file, no additional user interaction was required. The injected JavaScript immediately acquired full access to the contents of the loaded page. It could systematically harvest message text, sender names, publication timestamps, and the specific chat title and type, before covertly exfiltrating this sensitive intelligence to an external server. Furthermore, the script possessed the capability to entirely alter the displayed page, deceptively modifying messages, dates, and names, or even presenting a fraudulent authorization form. It is important to note that these alterations strictly affected the archive’s visual presentation within the browser, leaving the original correspondence residing on Telegram’s servers untouched.
This flaw created a profound issue regarding the Telegram bot access model. Typically, a bot operating with privacy mode enabled cannot perceive standard group correspondence or historical logs. However, the malicious message effectively bypassed this fundamental boundary post-export. The code executed natively within the user’s browser, effortlessly acquiring access to every single message present on the open HTML page. Researchers definitively assessed the severity of this vulnerability, assigning it an 8.2 on the CVSS 3.1 scale.
Discovery, Patching, and Lingering Dangers
The vulnerable code was initially introduced in Telegram Desktop 4.15.1 back in March 2024. Researchers Denis Rostilov and Alexander Rostilov identified the problem on June 1, 2026. A mere two days later, they responsibly disclosed the issue to Telegram, providing a comprehensive description, a demonstration, and a functional proof of concept. The developers formulated a patch on June 30, and on July 2, the crucial modification was integrated into the Telegram Desktop repository. This critical patch finally implemented the missing escaping protocols for button text, while simultaneously neutralizing an auxiliary code injection pathway previously available through the copy button handler.
The initial remediated test version, Telegram Desktop 6.9.4, was released on July 3, 2026, followed by the stable 7.0.1 release on July 14. Users must simply upgrade to Telegram Desktop 7.0.1 or a more recent build to ensure all newly generated exports correctly process button text.
The Threat of Legacy Archives
Critically, updating the client absolutely does not neutralize HTML files generated prior to the patch. If a legacy archive already harbors a message containing a weaponized button, the JavaScript remains perpetually embedded within the file, poised to execute the next time it is opened. Researchers strongly advise users to diligently re-export any necessary correspondence following the Telegram Desktop update. If opening older HTML archives is unavoidable, users should strictly do so with JavaScript explicitly disabled within the browser, particularly if the file contains the extensive history of a large group brimming with forwarded messages.
Telegram officially acknowledged the Telegram HTML export XSS report on July 1 and offered the researchers a $500 bounty. Commendably, the authors declined the payout, requesting instead that the funds be directed toward charity. According to the published correspondence, Telegram staunchly refused to authorize the public disclosure of specific vulnerability details, even after the patch was widely distributed, citing the persistent risk of future abuse. As of the research publication date on September 12, Telegram had not issued a dedicated security bulletin, and the vulnerability remained without an official CVE identifier.
Support Our Threat Intelligence
If you find our technology report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
