Author: DigitalSpying Security Desk
Date: September 14, 2026
Executive Summary
In a startling disclosure highlighting the risks of client-side data export features and the perils of vendor "silent patching," independent security researchers Denis Rostilov and Aleksander Rostilov of ExPatch have revealed a critical stored Cross-Site Scripting (XSS) and data exfiltration vulnerability in Telegram Desktop. As reported by The Hacker News, the vulnerability allows an adversary operating a Telegram bot—or any user forwarding a bot's message—to plant stealthy, unescaped JavaScript code inside inline keyboard buttons.
While the message appears completely innocuous within the native Telegram application interface, the payload lies dormant until a user utilizes Telegram’s popular "Export Chat History" feature to generate an HTML archive. When an exported messages.html file is subsequently opened in any modern web browser, the embedded JavaScript executes automatically without requiring user clicks or interaction. The malicious script has full access to the local Document Object Model (DOM), enabling it to exfiltrate complete message histories, timestamps, participant metadata, and local file paths to an attacker-controlled server, or dynamically alter the displayed text to falsify forensic records. Although Telegram quietly addressed the code defect in version 7.0.1, millions of legacy HTML exports generated between March 2024 and July 2026 remain permanently weaponized, while the vendor's refusal to issue a Common Vulnerabilities and Exposures (CVE) identifier or public security advisory leaves enterprise defenders in the dark.
Deep-Dive Technical Analysis
1. Vulnerability Architecture: The Unescaped Inline Keyboard Export
Telegram Desktop (supporting Windows, macOS, and Linux) features a native export module allowing users to archive conversations, media, and channel histories into navigable, browser-renderable HTML files.
* The Bot API & Inline Keyboards: Telegram bots frequently attach interactive buttons beneath messages, known as inline keyboards (InlineKeyboardMarkup). For URL-type buttons, the bot defines both the destination URL and the label text displayed on the button surface.
* The Sanitization Omission: Within Telegram Desktop’s export engine source code (history_exporter.cpp), user inputs are subjected to HTML entity escaping (converting characters like <, >, &, and " into <, >, &, and ") to prevent browser interpretation. While this sanitization was rigorously applied to message text, sender usernames, and forward headers, the developer neglected to sanitize the label text of inline buttons.
* Crafting the Payload: A threat actor could construct an inline keyboard button where the label contains an unescaped script tag:
By prepending and appending zero-width non-breaking spaces ( or ), the button appeared blank or minimally formatted in the native desktop client, arousing no suspicion during regular chat viewing.+----------------------------------------------------------------------------------------------------+
| TELEGRAM EXPORT XSS EXPLOITATION FLOW |
|---|
[Attacker Bot Creates Inline Keyboard]
Button Label: "" + Zero-Width Padding
|
v
[Native Telegram Desktop Client (v4.15.1 - v6.9.3)]
Button displays as normal/empty link button. No script runs in native Qt UI.
|
v (Member forwards message into VIP / Corporate / Private Group)
|
[Victim User Initiates "Export Chat History" -> HTML Format]
Export Engine escapes message text, BUT writes Button Label unescaped into messages.html
|
v
[messages.html Saved to Local Disk]
|
v
[Victim / Investigator / Legal Counsel Opens messages.html in Chrome / Firefox / Safari]
|
+---> 1. Browser parses