Researchers from ExPatch have disclosed a vulnerability in the desktop version of Telegram that allowed stealthy injection of JavaScript into exported chat histories. The flaw enabled attackers to embed malicious scripts within HTML exports without altering the visible appearance of messages inside the messenger itself.
The root cause lay in how Telegram Desktop handled button captions placed by bots beneath messages. While the application properly escaped dangerous characters in message text, sender names, and other fields, it failed to sanitize the text labels on inline buttons. Attackers could hide scripts using invisible characters, and the button-based payload persisted even after messages were forwarded between chats.
Once a user performed an HTML export in a vulnerable version, the script would execute automatically upon opening the file in any browser with JavaScript enabled. The code could copy conversation contents to a remote server or replace the displayed history with fake content such as a phishing form mimicking Telegram verification. Because large exports are split into separate files of one thousand messages each, the entire account remained protected, but individual chat segments were exposed.
The vulnerability existed in versions ranging from 4.15.1 to 6.9.3. A fix was included in beta release 6.9.4 and the stable version 7.0.1 published on July 14. Importantly, the patch does not retroactively secure previously generated HTML files, prompting researchers to recommend re-exporting old chats after updating or viewing legacy exports with JavaScript disabled.
No confirmed cases of real-world exploitation have been reported. The attack required three simultaneous conditions: use of a vulnerable Telegram Desktop version for export, presence of a malicious bot message in the exported chat, and opening the resulting HTML file in a browser with active scripting.
