Old Telegram chat exports may still contain a message-stealing bug

A vulnerability in Telegram Desktop allowed malicious code to hide inside exported chats and steal messages when the resulting HTML file was opened in a browser.

Telegram fixed the flaw in July, but the update does not repair files already saved on a computer. Old HTML exports may therefore remain dangerous, according to a security report published by ExPatch.

How the vulnerability worked

Telegram Desktop allows users to export conversations as HTML pages that can be viewed in a browser. The vulnerable versions of the app failed to properly process text placed inside buttons attached to bot messages.

An attacker could use this mistake to hide JavaScript inside an otherwise ordinary-looking button. The bot did not need to join the target chat because another user could forward its message into a private conversation or group.

Nothing happened while the message remained inside Telegram. The code became active only if someone exported the affected conversation as HTML and opened the file in a browser.

Once running, the script could read the messages displayed in that file and send them to an attacker-controlled server. It could also collect sender names, timestamps and basic information about the chat, or replace the page with a fake Telegram verification form.

Large Telegram exports are divided into separate files containing up to 1,000 messages. The vulnerability could expose the contents of the page being viewed, but it did not provide access to the user’s entire Telegram account or change the original conversation.

An attack also required several specific steps: the malicious bot message had to be included in the chat, the export had to be created with a vulnerable version of Telegram Desktop, and the user had to open it in a browser with JavaScript enabled.

ExPatch says the flaw was tested only with its own accounts and groups. The researchers did not report any attacks against real users.

How to protect yourself

The vulnerability affected Telegram Desktop versions 4.15.1 through 6.9.3. Telegram confirmed the report on July 1 and released the first stable version containing the security fix, Telegram Desktop 7.0.1, on July 14.

Users should update Telegram Desktop and recreate any HTML chat exports made with older versions. Old exports that are no longer needed should be deleted. If one must be opened, ExPatch recommends disabling JavaScript in the browser first.

The important distinction is that updating the app protects new exports. It does not make previously saved HTML files safe.