A stored cross-site scripting (XSS) vulnerability in Telegram Desktop could enable attackers to steal the contents of exported chat histories by embedding malicious code in an inline keyboard button, according to security researchers.
This issue affects the HTML chat export feature in Telegram Desktop builds released before Beta version 6.9.4 and Stable version 7.0.1. Researchers Denis Rostilov and Aleksander Rostilov of ExPatch Vulnerability Research reported the vulnerability to Telegram in June 2026.
Telegram addressed the issue through commit 8457d13a, which was included in Beta releases in early July and stable releases later that month. At the time of the researchers’ disclosure in September, no CVE identifier had been assigned.
Telegram Desktop XSS Vulnerability
The vulnerability exists in Telegram Desktop’s HTML export pipeline, which converts local chat data into browser-readable HTML files. While the application correctly escapes message text, usernames, and other content before adding them to exported files, it fails to sanitize text contained in inline keyboard buttons.1
As a result, HTML controlled by an attacker, placed in a bot-generated inline button, could be rendered as active browser markup when a victim opens an exported chat-history file.
The attack does not execute within the Telegram Desktop application itself, as Telegram’s native desktop client treats the malicious content as text rather than browser code. The risk arises only when a user exports a chat in HTML format and subsequently opens the generated file in a web browser with JavaScript enabled.
Researchers from Expatch noted that the vulnerable code path directly wrote button text into the export document without using Telegram Desktop’s existing `SerializeString()` sanitization routine. This routine escapes HTML-sensitive characters such as angle brackets, quotation marks, and ampersands.
A notable characteristic of this attack is that a malicious bot does not need to join a targeted group to deliver the payload. An attacker could send a crafted message containing a URL-based inline keyboard to another user or chat and then rely on someone to forward that message into a target group.
Telegram preserves certain URL-only inline keyboards when messages are forwarded, allowing a compromised button to remain embedded in a group’s message history for months before a participant exports that history to HTML.
This creates a uniquely persistent attack vector. The malicious content can remain dormant until a compliance review, legal request, internal investigation, or backup process prompts a user to export and view the conversation.
If the export includes the poisoned message, attacker-controlled JavaScript could access content rendered in the HTML document, including messages, sender names, timestamps, chat metadata, and the local file path.
The script could also alter the page’s visible content, enabling history manipulation or phishing overlays that impersonate Telegram prompts.
The researchers assigned the issue a CVSS 3.1 score of 8.2, classified as High, using the vector CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:N.
Telegram’s fix applies HTML escaping to inline button text before it is written into exported pages. The patch also addresses a separate JavaScript string injection risk in copy-callback buttons, where content was previously interpolated into an onclick handler without fully escaping backslashes and single quotation marks.
Users should update Telegram Desktop to version 7.0.1 or later on the stable channel or version 6.9.4 or later on the Beta channel. Organizations should treat pre-patch HTML exports as potentially unsafe.
Updating Telegram Desktop does not modify chat exports already saved to di2sk. Users should re-export sensitive conversations after upgrading or open legacy exports with JavaScript disabled.
This vulnerability underscores a common security risk in export functions: data that is harmless within an application’s native interface can become executable when serialized into HTML and opened in a browser.
Keep your SOC up to date on active malware & phishing within 24h of their emergence. Try ANYRUN to prevent incidents with early detection.
