Telegram Desktop Patch Closes HTML Export Vulnerability That Enabled Message Theft

A critical security flaw in Telegram Desktop’s HTML export function has been patched after researchers discovered that malicious actors could embed JavaScript within bot-generated inline keyboard buttons. When users exported their chat histories to HTML, the hidden scripts could execute and capture the contents of the conversation, effectively stealing private messages.

The vulnerability was classified as high severity because it leveraged a common user workflow—saving a chat as an HTML file—and required no additional user interaction beyond the export itself. Attackers would first create a bot that sent a message containing an inline keyboard. The keyboard’s button code could be crafted to include JavaScript payloads, which were then silently stored in the exported HTML file. Opening the file in a web browser triggered the script, allowing the attacker to harvest the page’s text and transmit it to a remote server.

Telegram responded by releasing updates to both the Desktop Beta (version 6.9.4) and the stable channel (version 7.0.1). The patches remove the ability to embed executable code in exported HTML and sanitize inline keyboard data before it is written to disk. Users are advised to update their clients promptly and to avoid opening older HTML exports from untrusted sources until they have been regenerated with the patched software.

The issue highlights a broader challenge for messaging platforms that offer export features. While providing users with the ability to back up or archive conversations is valuable, the export format must be carefully designed to prevent code injection. Security researchers have noted that similar risks have emerged in other applications that generate HTML or PDF files from user‑generated content, prompting a reassessment of how such data is sanitized.

Telegram has not disclosed whether any data was compromised before the fix, but the company’s swift remediation underscores its commitment to protecting user privacy. Security analysts recommend that users review their export settings, delete any previously saved HTML files that may contain malicious code, and monitor official channels for further guidance. The episode serves as a reminder that even widely used communication tools can harbor subtle vulnerabilities that require continual vigilance.