Telegram Desktop suffered a significant security flaw that allowed hidden JavaScript code to be embedded in user-exported HTML chat files, enabling attackers to exfiltrate private message data. This weakness was discovered by security researchers at ExPatch, who found that bots could plant malicious scripts within inline buttons under bot messages. These scripts execute when the HTML export is opened in a browser, providing the attacker full access to messages, senders, timestamps and more.
How the vulnerability worked
Telegram Desktop provides options to export single chats or all chats to HTML files, which users can open in web browsers. Until July 2026, the software allowed text associated with buttons in bot messages—known as inline keyboards—to be written directly into exported HTML without escaping. Normally, characters like “<” are converted to harmless entities during export; here, they were not, which meant a button’s label could actually contain a