Telegram Desktop HTML Export Flaw Can Steal Chats

A security flaw in Telegram Desktop allowed a bot's message to hide JavaScript inside chat exports saved as HTML files, researchers at ExPatch reported on September 12. The script would run when someone opened the exported file in a web browser, and it could send the contents of that file to an attacker-controlled server or change what the page displayed. The flaw affected Telegram Desktop, the desktop app for Windows, macOS, and Linux, which can export a single chat or all chats as pages that open in a browser.

Telegram bots can attach rows of clickable buttons under their messages, called inline keyboards, and the bot chooses the text shown on each button. Until the fix, Telegram Desktop's export feature wrote that button text directly into the HTML file without escaping it. Escaping is a standard safety step that converts characters like the less-than sign so a browser shows them as text instead of treating them as code. The export code did escape message text, sender names, and other fields, but not the button text. Researchers Denis Rostilov and Aleksander Rostilov found that a bot could put a script tag in a button's text, padded with invisible characters so the button looked empty in the Telegram Desktop version they tested. The bot did not need to be in the target chat: if a bot's message with only web link buttons is forwarded into a group, the buttons keep their content, so any member can carry the script into the chat's history. It then sits there until deleted and can be exported months or years later.

When an export file containing such a message is opened, the script runs without any further click. It can read every message in that file, including sender names and timestamps, the chat's name, type, and member count, and the local file path on the device. It can send all of that to the attacker's server. The export code splits long exports into separate files of 1,000 messages each, so one file exposes at most its own contents, not the whole chat or the Telegram account. The script can also rewrite the page: in the researchers' demonstration, it replaced the entire export with a fake Telegram "verification" form. The same control could change dates, senders, or message text in a file being used as a record. It does not change Telegram's own copy of the chat or the export file saved on disk. For the script to run, three things must be true: the HTML export was made with a Telegram Desktop version before the fix, the message carrying the script is inside the exported chat, and the file is opened in a browser with JavaScript enabled.

Telegram shipped a fix in July. Developer John Preston wrote the patch, commit 8457d13a, on June 30, and it added the missing escaping. The fix reached the 6.9.4 beta on July 3 and the 7.0.1 stable release on July 14 on GitHub. The affected versions run from Telegram Desktop 4.15.1, released in March 2024, through 6.9.3. The release notes for 6.9.4 and 7.0.1 do not mention the fix, the app's changelog does not mention it, and the Telegram Desktop repository lists no security advisories. There is also no CVE identifier for the flaw. The researchers rated it 8.2 out of 10 on the CVSS 3.1 scoring system. They reported the flaw to Telegram on June 3, two days after finding it, and said they tested only on their own accounts and test groups. Their writeup does not claim anyone has used it against real users. Telegram confirmed the flaw on July 1 and offered a $500 bug bounty, which the researchers declined and asked to be given to charity. They asked for a coordinated publication date and offered to stay silent until the patch shipped. In an email dated July 1 that the researchers published as a screenshot, Telegram Support wrote that public disclosure even of already addressed issues could put more Telegram users at risk, which the researchers read as a refusal to allow publication after a fix. They published on September 12 after the fix had shipped.

Users should update Telegram Desktop to 7.0.1 or later, or to 6.9.4 or later on the beta channel. After updating, they should export again any chats that were exported to HTML before the fix, or open the old files only with JavaScript disabled. Any HTML export made before the fix should be treated as untrusted, especially one from a large group where the origin of each message is hard to check. Until the app is updated, there is no reason to create new HTML exports, because only exports produced by the older code carry the flaw. As of September 14, Telegram had published no guidance for users holding older exports. For website owners and businesses that may receive or share exported chat archives, having a security-first review of any HTML file before it is hosted or distributed is a practical step; AEU-I provides security-first IT and consulting that can help assess such files.