A high-severity flaw in Telegram Desktop allowed attackers to steal chat messages through poisoned HTML exports. Malicious JavaScript hidden inside bot-created buttons could grab conversation content when you exported that chat as HTML and opened the file.
That is a nasty little chain. It starts with a bot sitting in a chat you already have, and it finishes with your private messages leaving your computer.
How a Bot Button Turns Into a Chat Thief
Telegram bots send buttons all day long. Confirm an order. Open a link. Vote in a poll. Those buttons are supposed to be harmless controls. The problem is they could carry malicious JavaScript.
Inside the live Telegram Desktop app, that kind of code is supposed to stay locked down. The break happened on export. When you saved a conversation as HTML, Telegram wrote out a real web page. Open that page in a browser and the script in the bot button can run the same way a script runs on any website.
Once it runs, it can read the chat sitting in that file and send it off the machine. You thought you were making a backup. You handed over a copy.
Why the HTML Export Is the Weak Link
People export chats for normal reasons. A small business keeps customer threads. A family saves a group before someone leaves. A shop owner wants a paper trail. HTML looks like the real conversation, which is why Telegram offers it.
HTML is not a document. It is a webpage. Webpages run code. JSON does not. A plain text dump does not. If a hostile bot planted JavaScript in a button before you hit export, your browser will treat that poison as part of the page.
You do not need to be famous for this to matter. You just need to export a chat that included the wrong bot, then open the file.
What Regular Telegram Users Should Do
This one gets under my skin because it punishes the responsible move. You saved a copy. The copy bit you. Big platforms keep adding features and then forget that regular people will use those features exactly as advertised.
If you use Telegram for work, a community group, or family, treat HTML exports like live webpages. Do not email them. Do not toss them in a shared folder. Do not open old ones you cannot account for.
- Update Telegram Desktop and leave auto-update on. These holes live longest on old installs.
- Be picky about bots. If you did not go looking for that bot, do not keep it in the chat.
- Do not open HTML chat exports from other people. Treat those files like a random attachment.
- If you need a backup, think twice before choosing HTML. A format that cannot run code is the safer copy.
- If you already exported chats that had unknown bots in them, do not reopen those HTML files until you know what you are looking at.
Keep the System Straight in Your Head
Bots are not your friends. Export is not a harmless Save As. A file that ends in .html is a webpage, not a printout. Hold those three facts and this whole class of problem gets a lot less dangerous.
Telegram feels private and easy. Easy is where corners get cut. When chat furniture like a bot button can ride along into a file your browser will execute, regular people pay for it. That is the system failing, not you being careless.
Primary Source: https://cybersecuritynews.com/telegram-desktop-flaw/