Telegram Desktop HTML Export Stored XSS Vulnerability

Security researchers at ExPatch identified a high-severity stored XSS vulnerability (CVSS 8.2) in Telegram Desktop affecting versions 4.15.1 through 6.9.3. The flaw resided in the `export_output_html.cpp` component, which failed to sanitize inline keyboard button text during the HTML export process. This allowed a malicious bot to plant hidden JavaScript payloads that remain dormant in chat history until a user exports the chat to HTML and opens the file in a web browser.

Technical analysis shows that the vulnerability could be triggered by any bot message containing a poisoned button, even if the bot never joined the target group, provided the message was forwarded into the chat by a participant. Upon execution in a browser, the script could exfiltrate all rendered messages, timestamps, and metadata to an attacker-controlled server, or perform a DOM takeover to replace the export view with phishing forms or forged chat history.

While Telegram addressed the issue in Stable version 7.0.1 (July 2026), the vendor reportedly declined to issue a public security advisory or coordinate disclosure. Crucially, existing HTML exports created with vulnerable versions remain dangerous and can still execute the embedded script if opened with JavaScript enabled. Organizations should mandate client updates and treat legacy HTML exports as untrusted artifacts.