A high-severity flaw in Telegram Desktop let attackers steal chat messages. Malicious JavaScript hidden in bot-created buttons could run when a conversation was exported as HTML and then opened. That is not some lab curiosity. It is a poisoned copy of your own chat.

Telegram Desktop lets you export a conversation as an HTML file so you can read it in a browser. People do that for records, handoffs, or a backup they actually control. The hole sat in how those exports handled buttons that bots dropped into the chat.

Bot Buttons Should Not Execute in Your Backup

Bots on Telegram can send messages with buttons. Inside the app, those buttons are supposed to stay inside Telegram. In the HTML export, malicious JavaScript stuffed into those buttons could ride along in the file.

Open that export in a browser and the script can run. Once it runs, it can steal the chat content sitting in that same file. You did not have to click a shady link that day. The trap was already in the conversation. The trigger was a normal backup.

This Is How Regular People Get Burned

Small shops use Telegram. Families use it. People who want a little distance from the usual big platforms use it. An HTML export is often the only local copy of a long thread.

If an attacker poisons that file, they are not skimming one joke. They can walk off with the whole conversation. Customer names. Family plans. Whatever you treated as private because it lived in a chat.

It pisses me off when a feature that is supposed to give you your own data turns into a delivery system for somebody else. You should not need a computer science degree to save your own messages.

What You Should Actually Do

• Do not open Telegram HTML exports in a regular web browser if the chat included bots you do not fully trust.
• Treat an HTML export like it might contain live code, not like a harmless printout.
• Keep Telegram Desktop updated. Old desktop clients are where holes like this hang around.
• Be stingy with bots in chats that hold anything you care about. An unknown bot is an unknown person with a keyboard.
• If a conversation matters, do not assume export equals a safe archive.

Control over your own data only works if the copy you make does not execute someone else’s script. That is the whole point of having a backup in the first place.

Primary Source: https://cybersecuritynews.com/telegram-desktop-flaw/