Researchers at ExPatch discovered a vulnerability in Telegram Desktop that allows attackers to inject malicious JavaScript into HTML-exported chat files. A bot can plant hidden code within ordinary-looking messages containing link buttons. The script remains dormant until a user opens the exported HTML file in a web browser, at which point it executes and exfiltrates all message content from that export.
The attack chain begins when a threat actor controls a bot account in a Telegram chat. The bot sends a message that appears benign to users viewing Telegram's interface, displaying only a link button. However, the message contains embedded JavaScript payload that Telegram Desktop fails to sanitize when generating HTML exports. Users who export their chat history through Telegram's export function receive an HTML file containing the malicious code. Once opened in a browser, the script executes with full access to the page's DOM and can extract every message visible in the exported file.
This vulnerability creates a specific but real risk for users who regularly export chat histories. Organizations using Telegram for sensitive communications face exposure if employees export conversations and open those files. Researchers and journalists relying on Telegram for source protection could inadvertently leak exported message archives containing sensitive information. The attack requires minimal technical skill from the threat actor and exploits a fundamental weakness in how Telegram Desktop processes message content during export operations.
The vulnerability stems from insufficient input validation and output encoding. Telegram Desktop should filter or escape any JavaScript-like content before embedding it into HTML exports. The platform instead trusts message content and renders it directly into the export file without proper sanitization. This reflects a broader issue where applications fail to distinguish between data displayed within their native UI and data exported to web-standard formats where scripts execute by default.
ExPatch researchers responsibly disclosed the flaw through standard vulnerability reporting channels before publishing their writeup on September 12. The timeline between discovery and public disclosure remains unclear, but responsible disclosure practices suggest Telegram received notification before the public announcement. Users should assume the flaw existed in versions released before the disclosure date.
Mitigation requires Telegram to implement strict content sanitization for HTML exports. The company should either strip all HTML and JavaScript from exported messages, rendering them as plain text or properly escaped content, or implement a strict Content Security Policy within exported files that blocks script execution entirely. Until patching occurs, users should avoid opening HTML exports in browsers and instead use Telegram's built-in archive search and export features within the application itself, where the platform controls execution context.
This incident underscores the importance of treating exports as potentially hostile content. Users exporting sensitive conversations should verify they understand the file's destination and who may access it. Opening HTML exports from untrusted sources in browsers carries inherent risk until Telegram addresses this flaw. The vulnerability affects all users relying on the export feature for record-keeping or compliance purposes.