Hidden Scripts in Ordinary-Looking Messages
Telegram Desktop had a critical flaw in its HTML export feature: button text inside a message wasn't properly escaped, allowing an attacker-controlled bot to embed a hidden script tag that would execute the moment a victim opened an exported chat file in a web browser.
How the Attack Worked
A malicious bot could embed a script tag inside a message's button text, padding it with invisible characters so the button appeared blank inside the Telegram app itself. If that message was forwarded into a group chat, it would persist quietly in the chat history — potentially for months — until someone exported that conversation to HTML. Opening the resulting export file in a browser would trigger the hidden script automatically, with no further interaction from the victim required.
What the Injected Script Could Do
| Capability | Description |
|---|---|
| Data exfiltration | Extract all messages, sender names, timestamps, and chat metadata from the export |
| Remote exfiltration | Send the stolen data to an attacker-controlled server |
| Content spoofing | Modify the exported page — researchers demonstrated a fake Telegram verification form |
| History tampering | Alter displayed dates, senders, or message text within the exported file |
Discovery and Disclosure
The flaw was identified by ExPatch researchers Denis and Aleksander Rostilov, who reported it to Telegram on June 3, 2026, and rated it 8.2 out of 10 on the CVSS 3.1 scale. No CVE identifier was assigned, and Telegram declined the researchers' request for coordinated public disclosure alongside the patch.
Patch Status
Telegram fixed the issue in Desktop version 7.0.1, released July 14, 2026 — despite the underlying bug having existed since March 2024. Critically, the fix does not retroactively sanitize HTML files that were already exported before the patch. Any export generated with a pre-7.0.1 client remains vulnerable if opened today.
Recommendations
- Update Telegram Desktop to version 7.0.1 or later immediately
- Re-export any chats you need in HTML format after updating, rather than reusing old export files
- Disable JavaScript in your browser before opening any HTML export created before July 2026
- Treat old exports as untrusted — do not open them in a browser with an active session to sensitive accounts
References
- The Hacker News — Telegram Desktop Flaw Lets Hidden JavaScript Exfiltrate Messages From HTML Exports