Stored XSS in Telegram Desktop Allows Silent Data Exfiltration via Chat Export

Researchers at ExPatch Vulnerability Research discovered a stored XSS vulnerability in Telegram Desktop that could be triggered when users exported chat history to HTML. The flaw resided in export_output_html.cpp where button text from inline keyboards was not passed through the SerializeString function, allowing arbitrary HTML and JavaScript to execute upon opening the exported file. Attackers could deliver the payload through a bot that never joined the target group, relying on message forwarding to reach victims. Once executed, the script exfiltrated all visible messages, chat metadata, and file paths to an attacker-controlled server while optionally replacing the page with a phishing form. Telegram issued a silent fix in Beta v6.9.4 and Stable v7.0.1 without publishing an advisory or assigning a CVE. The researchers refused the offered bounty and published the details after the patch to inform users about risks from previously exported files.

Researchers from ExPatch Vulnerability Research have disclosed a stored cross-site scripting vulnerability in Telegram Desktop that allowed attackers to exfiltrate chat contents when users exported conversation history to HTML.

The issue was introduced in commit 52c779bf in early 2024 and shipped in stable release v4.15.1. The vulnerable code in export_output_html.cpp directly wrote button.text.toUtf8() into the generated HTML without escaping, while all other message fields were processed by SerializeString().

An attacker could create a bot that sent a single message containing an inline URL button whose text field held invisible Unicode characters followed by a