In short: Researchers Denis Rostilov and Aleksander Rostilov at ExPatch Vulnerability Research disclosed an XSS flaw in Telegram Desktop (versions 4.15.1–6.9.3): malicious JavaScript hidden in bot keyboard button labels executed when users opened exported HTML chat histories in a browser, potentially exfiltrating message content to an attacker's server. The vulnerability is patched in version 7.0.1, but previously saved HTML exports remain dangerous — delete them or open with JavaScript disabled.
What happened: a flaw inside the chat export feature
On September 12, 2026, Denis Rostilov and Aleksander Rostilov of ExPatch Vulnerability Research published a full technical write-up of an XSS vulnerability in Telegram Desktop. Multiple cybersecurity outlets including CyberInsider and Anti-Malware.ru covered the disclosure on September 14.
Telegram Desktop's HTML export feature lets users save a full chat history to a local archive — a straightforward function popular with people who want an offline copy of their conversations. The bug lived inside this exact feature and affected versions from 4.15.1 through 6.9.3, meaning anyone who exported chats during those years could have affected files on their device.
ExPatch reported the issue to Telegram on June 3, 2026. The team moved quickly: a patch landed in beta version 6.9.4 (July 3) and the stable release 7.0.1 (July 14). Public disclosure came two months after the fix — standard responsible-disclosure practice giving users time to update before the technical details went public.
How the attack works: JavaScript hiding in a bot button
Telegram Desktop correctly sanitised (escaped) potentially dangerous characters in message text and sender names when generating HTML exports. However, it failed to sanitise the label text of inline keyboard buttons — the clickable buttons bots place beneath messages. That single omission was enough.
The attack chain has three steps. Step one: an attacker creates or compromises a bot and sends a message to the target chat with a button whose label contains a hidden <script> tag. Inside the messenger the message looks completely normal — no malicious code is visible. Step two: the victim exports the chat to HTML using a vulnerable version of Telegram Desktop. Step three: the victim opens the saved HTML file in a browser — and the embedded script executes. At that point it can copy visible page content (messages, sender names, timestamps) and send it to a remote server, or replace the displayed interface with a phishing form.
Critically, the attack does not fire inside Telegram itself. Exploitation requires all three conditions to align: a vulnerable app version, a malicious message in the exported chat, and the user opening the HTML file in a browser. No confirmed cases of in-the-wild exploitation have been reported.
What data was at risk
When triggered, the injected JavaScript can access the contents of the open HTML page. That means an attacker could potentially obtain:
- message text from the exported conversation;
- participant names and usernames;
- message timestamps;
- other metadata — reactions, forwarded messages, file captions.
The script cannot reach other files on the computer or access your Telegram account directly — it operates only within the bounds of the open HTML document. Even so, for professional or personal conversations, that scope of exposure can be sensitive. Our privacy and security blog covers messenger security practices in more depth.
Who is at risk: how to tell if you are affected
You are potentially affected if all three of these are true: you used Telegram Desktop versions 4.15.1 through 6.9.3, you exported chats to HTML during that period, and you kept those files on disk. Simply using a vulnerable version without exporting is not a risk — the flaw only lives inside saved HTML files, not inside the messenger itself.
Corporate users and freelancers who routinely archive business conversations deserve extra attention here, as do people who work in group chats with bots — bots are the delivery mechanism for the malicious payload. To check your Telegram Desktop version, open the menu → About Telegram.
How to protect yourself right now
Steps in priority order:
- Update Telegram Desktop to version 7.0.1 or later. In current versions button labels are properly sanitised and new HTML exports are safe.
- Delete old HTML exports created with versions prior to 7.0.1. Updating the app does not retroactively fix already-saved files. If you need the archive, re-export from the updated version.
- Do not open old Telegram HTML files if you are unsure which version created them. At minimum, disable JavaScript in your browser before opening (Chrome: Settings → Privacy and Security → Site Settings → JavaScript).
- Be cautious about bots in important chats. A bot message with an unfamiliar button in a high-value conversation is a reason to investigate before exporting that chat.
At the network layer, a VPN like LiMP VPN encrypts traffic between your device and the internet, hiding from your ISP which resources you connect to. That is a separate layer of privacy protection — it operates at the network level and does not patch application vulnerabilities. Closing a hole in Telegram requires an update; encrypting your connections so nobody along the route can see what you access is what a VPN does. See our pricing page for plan details.