Telegram Desktop bug let a hidden script steal chats from saved conversations

Key points

• Researchers at ExPatch disclosed the flaw on September 12, showing a bot could smuggle hidden code into Telegram Desktop chat exports.
• The message looked like an ordinary link button in the app, giving no visible warning.
• The hidden JavaScript only ran once a user saved the chat as an HTML file and opened it in a browser.
• Once triggered, the script could copy every message in the exported file and send it to an attacker.
• Users who never export their chats to HTML weren't exposed by this specific trick.

A newly disclosed weakness in Telegram Desktop, the version of the messaging app people install on Windows and Linux and Mac computers, let attackers hide working code inside chats that users later saved to their hard drive.

Security researchers at ExPatch published the writeup on September 12. First reported by The Hacker News, the technique turned a routine feature, exporting a chat to an HTML file for backup or record-keeping, into a quiet way to steal the entire conversation. Telegram has been a recurring subject for us: our report on the Xinbi Guarantee takedown on 9 September showed how deeply the platform has become embedded in organised criminal infrastructure.

What actually happened?

A malicious bot could send a message that looked completely normal in the app, right down to a tidy link button. Nothing flagged as suspicious while you were reading it in Telegram itself.

The trick sat in the underlying message data. When Telegram Desktop wrote that chat to an HTML file, the hidden JavaScript, small pieces of programming that web browsers run automatically, was baked into the saved file. Open it in a browser, and the code ran, reading every message in the export and sending the contents to a server the attacker controlled.

Who is at risk?

Only people who actually export their Telegram chats to HTML and open the resulting file in a browser. If you use Telegram only inside the app, this flaw doesn't touch you.

That still covers a real slice of users: journalists archiving sources, lawyers keeping records, support teams saving customer threads. Those are exactly the people whose chat history is worth stealing.

How bad is the flaw in practice?

Bad, in the sense that the victim sees nothing wrong at any point until the data is already gone. The attacker needs the victim to do two things: interact with a bot's message, then export that chat to HTML. Neither step is unusual.

Bots are a normal part of Telegram life. People add them for news, reminders, file conversion, group moderation. A poisoned message from one of those bots is enough to seed the payload.

This isn't remote code execution against the desktop app itself. It's data theft that fires the moment you double-click your own backup file. In some ways that's worse, because the harmful action feels like housekeeping.

What should Telegram users do?

A few practical steps:

• Avoid exporting chats to HTML from conversations that include bots or strangers. JSON export, a plain data format, doesn't run code when opened.
• If you already have HTML exports on disk, don't open them in a browser until you know Telegram Desktop is patched on the machine that created them.
• Update Telegram Desktop as soon as a fix is available.
• Treat unknown bots the same way you'd treat an unknown email attachment.

The honest read

This one stings because the app was doing exactly what users asked. Export the chat. Save the file. The failure was in trusting bot-supplied content enough to render it as live code later. Sanitising message content on export is the sort of unglamorous engineering work that gets postponed until a researcher forces the issue. Multi-factor authentication wouldn't have helped here; this was about how a saved file was built, not about who was logged in.