A flaw in Telegram Desktop allowed a bot message to hide JavaScript inside HTML chat exports, letting attackers steal exported chat contents or alter what users saw when opening the file in a browser. Telegram fixed the issue in later versions, but older HTML exports made before the patch can still be dangerous and should be treated as untrusted. #TelegramDesktop #Telegram #JohnPreston
Keypoints
- Telegram Desktop HTML exports failed to escape bot button text properly.
- A malicious bot could hide JavaScript in an exported chat file.
- The script could exfiltrate messages, names, timestamps, and file paths.
- The flaw could also rewrite the exported page to show fake content.
- Telegram fixed the bug in 6.9.4 beta and 7.0.1 stable, but old exports remain risky.
Read More: https://thehackernews.com/2026/09/telegram-desktop-flaw-lets-hidden.html