Researchers identified a stored XSS vulnerability in Telegram Desktop that allowed malicious code to execute when a user exported chat history to an HTML file. The flaw originated from the failure to properly sanitize the text field of inline buttons, which could contain arbitrary HTML or JavaScript.
An attacker could create a bot to send a message with a specially crafted button containing hidden script tags. Because Telegram preserves these buttons during message forwarding, the malicious code could reach large groups without the bot ever joining them. The script would execute automatically in the browser upon opening the exported HTML file.
Once triggered, the script could exfiltrate chat messages, metadata, and system information to a remote server, or manipulate the displayed content to facilitate phishing. The vulnerability was assigned a CVSS 3.1 score of 8.2, categorized as High, as it allowed for potential data theft and content modification.
The issue was reported to Telegram on June 3, 2026. A fix was implemented in commit 8457d13a, released in Beta v6.9.4 on July 3, 2026, and Stable v7.0.1 on July 14, 2026. Telegram declined to approve public disclosure, citing security risks, despite the researchers' refusal of a $500 bounty.
Users are advised to update their Telegram Desktop clients and re-export any previously saved HTML chat histories, as the update does not retroactively secure existing files. The researchers noted that no official advisory or CVE identifier was issued by Telegram regarding this vulnerability.
