Telegram Desktop bug enables hidden JavaScript to siphon data from exported chats

Security researchers from the ExPatch project disclosed a vulnerability in the Telegram Desktop client that lets hidden JavaScript code run when a user opens an exported chat history in a web browser, potentially leaking private messages to an attacker.

The flaw is triggered by a seemingly ordinary message that contains a clickable button. When a user chooses the built‑in "Export chat history" feature and selects the HTML format, the exported file embeds the button along with a concealed script tag. The script is invisible in the chat view but executes automatically when the HTML file is opened, allowing the attacker to harvest the content of the export and send it to an external server.

ExPatch published a technical write‑up on September 12 outlining the mechanics of the exploit. According to the researchers, the issue is confined to the desktop version of Telegram and does not affect the mobile apps, which use a different rendering pipeline for exported data. The malicious payload is injected at the moment the original message is received, meaning the compromised script can persist in any subsequent export until the offending message is deleted.

While the attack requires a user to actively open the HTML export—an action many people take to archive conversations or migrate them to other platforms—the potential privacy impact is significant. An adversary could retrieve entire chat histories, including private links, photos, and personal identifiers, without the victim’s knowledge. Because the exploit leverages standard web technologies, it can operate across browsers and operating systems.

Telegram responded to the disclosure by acknowledging the bug and confirming that a patch is being rolled out to all desktop clients. In a brief statement, the company advised users to update to the latest version as soon as it becomes available and to avoid opening HTML exports from unknown sources until the issue is resolved.

The incident highlights a broader challenge for messaging services that offer export functions. Sanitizing user‑generated content for multiple output formats is a complex task, and even well‑reviewed code can overlook edge cases that enable script injection. Security researchers have previously identified similar problems in other platforms, prompting industry‑wide calls for stricter content‑filtering mechanisms.

Telegram users are urged to monitor the update channel for the forthcoming fix and to consider alternative export formats, such as JSON or plain text, which are less susceptible to script execution. As the patch propagates, the episode serves as a reminder that seemingly harmless features like chat exports can become vectors for data exfiltration if not rigorously secured.