Telegram Desktop Flaw Lets Hidden JavaScript Exfiltrate Messages From HTML Exports

This is a solid find from ExPatch. The attack chain is deceptively simple but effective against users who rely on Telegram’s HTML export feature for record-keeping.

Technical Breakdown:

• Attack Vector: Stored XSS via crafted messages. An attacker sends a message containing a benign-looking link button, but the underlying payload includes obfuscated JavaScript.
• Trigger: The script executes client-side when the user opens the exported .html file in a browser. It does not execute within the Telegram Desktop app itself.
• Exfiltration: Once the HTML file is opened, the JS can read the DOM of the exported chat log and exfiltrate all visible messages to an attacker-controlled endpoint.
• Scope: This affects any user who exports chats containing the malicious message. The attacker does not need to be in the same chat after the message is sent; the payload persists in the export.
• No CVE listed yet, but this is a classic case of insufficient output sanitization in the export template.

Defense:

• Immediate: Do not open exported HTML files from untrusted chats in a browser. Use a text editor or a sandboxed viewer.
• Mitigation: Telegram needs to strip or encode HTML/JS entities in the export template. Until patched, users should export to JSON or use the desktop app’s built-in search instead of relying on HTML exports for sensitive conversations.
• Detection: Monitor for outbound connections from browser processes when viewing local .html files, especially if the user is not actively browsing the web.

Source: https://thehackernews.com/2026/09/telegram-desktop-flaw-lets-hidden.html