Telegram Desktop Fixes HTML Export Bug That Allowed Message Hijacking

Researchers have now patched a serious vulnerability in Telegram Desktop’s HTML export feature after finding that attackers could insert JavaScript into inline keyboard buttons generated by bots. Exporting a chat to HTML would embed these concealed scripts, which could run and siphon the conversation’s text, resulting in the theft of private messages.

The flaw was rated high severity because it exploited a routine user action—saving a conversation as an HTML file—and required no extra clicks beyond the export. An attacker would first deploy a bot that sent a message with an inline keyboard; the button’s code could be crafted to contain JavaScript payloads, which were then silently written into the exported HTML. Opening that file in a browser would execute the script, letting the attacker collect the page’s text and relay it to a remote server.

In response, Telegram issued updates for both the Desktop Beta (v 6.9.4) and the stable release (v 7.0.1). The fixes strip out the ability to embed executable code in the HTML export and cleanse inline‑keyboard data before it is saved to disk. Users should promptly apply the updates and refrain from opening older HTML exports from unknown sources until they are regenerated with the patched version.

This incident underscores a wider issue for messaging services that provide export capabilities. While the option to back up or archive chats is useful, the export format must be built to block code injection. Security researchers have pointed out that comparable dangers have appeared in other tools that produce HTML or PDF files from user‑generated input, prompting a reevaluation of sanitization practices.

Telegram has not confirmed whether any data was exposed before the patch, but the rapid response highlights its dedication to user privacy. Analysts advise users to check their export configurations, delete any previously saved HTML files that might contain malicious code, and stay tuned to official channels for additional instructions. The case serves as a reminder that even popular communication platforms can contain subtle flaws that demand ongoing vigilance.