A high-severity vulnerability in Telegram Desktop could allow malicious code hidden in a chat message to run when a user exports the conversation as HTML and opens the resulting file in a web browser.
Security researchers Denis Rostilov and Aleksander Rostilov of ExPatch disclosed the stored cross-site scripting, or XSS, vulnerability after a fix had been released.
The researchers assigned the issue a CVSS score of 8.2 out of 10, rated High. The flaw affected HTML exports produced by Telegram Desktop versions before beta 6.9.4 and stable version 7.0.1.
How the Telegram Desktop Vulnerability Worked
Telegram Desktop allows users to export conversations as HTML files that can later be opened in a web browser.
According to the researchers, Telegram properly protected several types of content when creating those files, including regular message text and sender names. However, text contained inside certain inline buttons was not handled in the same way.
That meant specially crafted button text could be written into the exported page as active HTML or JavaScript instead of ordinary text.
An attacker could place the malicious content inside a message created by a Telegram bot. That message could then be forwarded into another group, potentially allowing the payload to reach a conversation even if the bot itself was never a member of the group.
Nothing would happen simply from viewing the message normally in Telegram. The malicious code would become active only if a user later exported a conversation containing the message as HTML and opened that export in a browser.
Once an affected HTML export was opened, the injected code could access information displayed on the page.
The researchers demonstrated access to exported message text, sender information, timestamps and chat metadata. Because the code ran inside the exported webpage, it could also change what appeared on screen or potentially send information from the open document to an external server.
The vulnerability did not provide direct access to a user’s Telegram account or automatically expose conversations simply because a malicious message was present. Exploitation required the user to create an HTML export containing the affected message and then open that file.
The vulnerability was reported to Telegram in June 2026. The fix later appeared in Telegram Desktop beta 6.9.4 and stable version 7.0.1, which was released in July.
Telegram’s official Desktop changelog confirms that version 7.0.1 was released on July 14. Newer Telegram Desktop releases have since become available. Users running Telegram Desktop should update to the latest available version.
Older HTML Chat Exports May Still Pose a Risk
Updating Telegram Desktop fixes the problem when creating new HTML exports, but it does not change files that were already saved to a computer. According to the researchers, an HTML chat export created with an affected version could still contain malicious code if the vulnerable content was present when the file was generated.
Users who previously exported Telegram conversations as HTML should consider recreating those files after updating Telegram Desktop. The researchers also recommend caution when opening older HTML exports, particularly those created from large groups where forwarded messages may have come from many different sources. Keeping Telegram Desktop updated prevents newly created exports from being affected by the flaw, but older HTML files remain separate from the application and are not automatically repaired when the software is updated.
Leave a Reply