Chat histories saved from Telegram Desktop can carry a hidden payload, and updating the app will not clean up old files. Researchers at ExPatch detailed the issue in a writeup published September 12.
The desktop client can export conversations as HTML pages meant to open in a browser. Bots, meanwhile, may attach rows of buttons, which Telegram calls inline keyboards, and they control the wording on each one. Before the fix, the export routine dropped that wording into the page raw. Padding the text with invisible characters let a bot tuck a script tag into what looked like an empty button.
Reaching a target chat is not required. A message whose buttons are all links keeps them when forwarded, so anyone in a group can unknowingly move the script along. It then waits in the history until someone exports it, which could be years later.
Simply opening an affected export in a browser triggered the code, with no click needed. Everything in that file, including sender names, timestamps, and chat metadata, could be shipped to an attacker’s server. The script could also redraw the page; one demo swapped the export for a fake Telegram verification form.
Telegram’s fix landed in versions 6.9.4 and 7.0.1. Files exported earlier still behave the old way. ExPatch rates the flaw 8.2 under CVSS 3.1. There is no CVE, and Telegram’s changelog says nothing about it.
The guidance is straightforward. Move to 7.0.1 or newer, export fresh copies of any chats saved as HTML before the fix, and treat the old files as untrusted.
