Telegram Desktop Bug Exposes Exported Chats to Hidden Code

Robert Moore · 2026-09-14

### The Hidden JavaScript That Waits in Your Exported Chats Imagine you're wrapping up a project and decide to save a Telegram conversation as an HTML file for your records. Months later, you open that file in your browser to find a reference. But what if that innocent-looking file was booby-trapped? That's exactly what security researchers at ExPatch uncovered in a recent writeup. A flaw in Telegram Desktop allowed a bot to plant hidden JavaScript inside chat messages. When you exported the chat to an HTML file and opened it in a browser, that script sprang to life. It could then copy every message in that file and send it off to who-knows-where. The kicker? In the Telegram app itself, the message looked completely normal—just a link button. No red flags, no warnings. ### How the Attack Slips Under the Radar Here's the thing: Telegram exports are meant to be a safe way to back up your conversations. You get a neat HTML file that you can browse offline. But this flaw turned that feature into a potential data leak. The malicious script only ran when you opened the export in a web browser, not inside Telegram. So if you never opened the file, you were safe. But who doesn't open their exports to check them? The researchers published their findings on September 12, and it's a stark reminder that even trusted apps can have blind spots. Telegram has since patched the issue, but the incident raises bigger questions about how we handle our digital conversations. ### Why This Matters for Privacy-Conscious Users If you're like me, you probably use Telegram for everything from work chats to family group messages. Exporting those chats is a common practice—maybe you want to archive a important discussion or move to a new device. But this flaw shows that even a simple export can become a vector for attack. - **Bots can be weaponized:** A malicious bot could send a message that looks harmless but contains hidden code. - **Exports are vulnerable:** The HTML file format can carry scripts that execute when opened in a browser. - **User awareness is key:** Many people don't realize that exported files can be as risky as clicking a random link. > "The line between a convenient feature and a security hole is often thinner than we think." ### What You Can Do to Stay Safe First, update Telegram Desktop to the latest version—the patch is already out. Second, be cautious about opening exported HTML files in a browser. If you need to view them, consider using a text editor or a secure viewer that doesn't execute scripts. Third, think twice before interacting with bots, even ones that seem official. This isn't about ditching Telegram; it's about staying informed. The digital world is full of clever traps, and a little skepticism goes a long way. So next time you export a chat, take a moment to consider where that file might end up—and who might be waiting inside.