Uncovering the Hidden Payload Risk in Telegram HTML Chat Exports

A Telegram message can look completely harmless in the app, sit inside a group for months, and still become an attack when someone eventually exports that chat.

Researchers found a stored Cross-Site Scripting (XSS) flaw in Telegram Desktop's HTML export feature. XSS is a vulnerability where attacker-controlled content is interpreted as executable JavaScript rather than ordinary text.

The problem was in inline keyboard buttons, the buttons that appear underneath bot messages. Telegram Desktop failed to properly escape the button text when generating an HTML export, this allowed an attacker to hide JavaScript inside the button's text. In Telegram itself, the content appeared harmless because the app treated it as plain text. In the exported HTML, however, a browser could interpret it as code.

The Attack

The attack is essentially:

Malicious bot message → forwarded into a chat → chat is exported as HTML → victim opens the file → hidden JavaScript executes → exported messages are exposed

The clever part is that the attacker does not necessarily need to join the target group.

A malicious bot can create the poisoned message. That message can then be forwarded into another group, carrying the malicious button with it. The payload can remain dormant in the conversation until somebody exports the chat.

When the resulting HTML file is opened in a browser, the JavaScript executes automatically. Researchers demonstrated that it could read the messages and metadata displayed in the export, including sender names, timestamps, chat information and message content, and send that information to an attacker-controlled server. The injected code could also rewrite the page and display a fake Telegram verification screen, creating an opportunity for credential phishing.

This creates an unusual delayed attack where the victim does not need to click a malicious link in Telegram, They may simply be doing something legitimate months later such as exporting a conversation for backup, compliance, investigation or legal evidence and then opening the exported file.

The vulnerability reportedly existed since Telegram Desktop 4.15.1, released in March 2024. Telegram fixed it in Beta 6.9.4 and Stable 7.0.1 in July 2026. No CVE had been assigned at the time of disclosure.

Why It Matters

Users trust the Telegram application to safely display messages. They also generally trust an exported chat because it is simply a record of their own conversation. The vulnerability breaks that assumption. For organisations using Telegram for sensitive communications, the biggest concern is therefore not just the application itself, but the old HTML exports already sitting on endpoints, shared drives or investigation folders.

Updating Telegram does not clean those files because if an old export contains the malicious payload, it remains potentially dangerous when opened.

Recommendations

• Patch Telegram Desktop to 7.1.3 and prioritise users handling Telegram exports for investigations or intelligence.

• Monitor for legacy Telegram HTML files followed by unusual process execution or outbound connections.

• Treat pre-patch exports obtained during investigations as untrusted artifacts and incorporate related IOCs into monitoring.

• Restrict or isolate execution of legacy HTML exports and apply appropriate JavaScript controls.

• Validate exposure through controlled testing and use findings to strengthen detection and endpoint controls.

‍