A stored XSS vulnerability in Telegram Desktop enables attackers to exfiltrate sensitive chat history and perform DOM manipulation when a user opens an exported HTML file containing a malicious payload.

This vulnerability occurs due to improper neutralization of input within the button.text.toUtf8 function in export_output_html.cpp. An unauthenticated attacker can inject malicious HTML and script tags into inline keyboard button text, which is then rendered unsanitized during the HTML export process.

Successful exploitation allows an attacker to gain unauthorized access to an entire exported chat history, including sensitive internal communications, credentials, or proprietary information. Because the payload executes within the context of the user's browser, the attacker can also perform full DOM takeover, leading to potential credential harvesting or further malicious actions. With a CVSS score of 8.2, this vulnerability represents a significant risk to organizational confidentiality and integrity.

Immediate Action: Update Telegram Desktop to version 7.0.1 or later to apply the necessary sanitization logic to the HTML export pipeline.

Proactive Monitoring: Security teams should monitor internal environments for unusual outbound network traffic from workstations, particularly following the use of chat export features.

Compensating Controls: Advise employees to exercise caution when opening HTML files generated from chat exports and consider using isolated browser environments to view sensitive offline documents.

Public Exploit Available: Yes, a published proof-of-concept exists in the technical write-up by ExPatch.

The severity of this vulnerability, combined with the availability of technical details regarding the exploit mechanism, necessitates immediate action. Organizations should prioritize updating all instances of Telegram Desktop to version 7.0.1 or higher to ensure the patch is applied. Users should be educated on the risks of opening exported chat files from untrusted or unverified sources until all endpoints are confirmed to be running the remediated version.