Poisoned Messages Turn Saved Conversations Into an Attack Surface
Security researchers Denis and Aleksander Rostilov of ExPatch discovered a stored cross-site scripting vulnerability in the HTML export functionality of Telegram Desktop. The issue allowed malicious JavaScript to be embedded in a message and executed later when an exported conversation was opened in a browser.
The attack did not require the malicious bot to join the victim's group. A crafted bot message containing a malicious inline keyboard could be forwarded into other conversations and remain dormant until someone exported the chat as HTML.
The Export Process Was the Weak Link
The vulnerability originated inexport_output_html.cpp, where inline keyboard button text was written into the generated HTML without passing through Telegram Desktop's existingSerializeString()sanitization routine.
As a result, HTML placed inside a button'stextfield could be interpreted as active markup, including JavaScript. The Telegram client itself did not execute the payload; execution occurred when the exported HTML document was opened in a browser.
One Forwarded Message Could Be Enough
Because poisoned messages could be forwarded, a single malicious message could reach multiple groups. The payload could then remain hidden in conversation history for months or even years before being triggered by a legitimate export operation.
Attackers Could Read and Manipulate Exported Data
Researchers demonstrated that injected JavaScript could access messages, sender names, timestamps and other information rendered in the exported page before sending the data to an attacker-controlled server.
The script could also obtain the local path of the exported file and modify the page itself. In a proof of concept, researchers replaced the conversation with a fake Telegram verification page and altered displayed messages and timestamps.
Importantly, this did not modify the original conversation stored by the service. The risk was concentrated in the exported HTML and the browser session used to open it.
Vulnerability Existed for More Than Two Years
The vulnerable code was introduced in February 2024 and reached the stable 4.15.1 release the following month.
ExPatch reported the issue on June 3, 2026, and the vendor fixed it in June. The first patched beta was version 6.9.4, while the first stable release containing the fix was 7.0.1, released July 14.
Old HTML Files Are Still a Risk
Updating the application does not clean previously generated exports. A malicious script already embedded in an old HTML file remains there and can execute when the document is opened.
Organizations that archive conversations for investigations, compliance or business purposes should therefore treat older HTML exports as potentially untrusted and regenerate sensitive exports after updating.