As cited
Copy frozen at (site build).
vulnerabilities
Telegram Desktop Flaw Lets Hidden JavaScript Exfiltrate Messages From HTML Exports
Telegram Desktop contained a vulnerability that allowed malicious JavaScript to be injected into HTML export files through crafted bot messages. When a user opened the exported file in a browser, the hidden script could exfiltrate the message contents from that file.
Why it matters: Telegram Desktop users who export chats to HTML and open them in a browser face data theft risk if they receive messages from compromised bots; patch or avoid opening exports in browsers until fixed.
- Source published
- First seen by Cybersecurity Tracker