Telegram Desktop Flaw Could Turn Old Chat Exports Into Data Theft Traps

A Telegram Desktop flaw let bots inject JavaScript into exported chats, enabling data theft and page manipulation. Old HTML exports remain unsafe. A vulnerability in Telegram Desktop could have turned an ordinary chat export into a serious data leak. Security researchers Denis and Aleksander Rostilov of ExPatch found a stored cross-site scripting flaw in the application’s HTML export feature that allowed malicious JavaScript to hide inside a Telegram message and run later when someone opened the exported file in a browser. “A stored XSS in Telegram Desktop lets an attacker plant invisible Java