Critical Telegram Desktop Bug CVE-2023-34399 Exposes Chat Messages

Key Takeaways

• A critical cross-site scripting (XSS) vulnerability, CVE-2023-34399, was discovered in Telegram Desktop.
• The flaw allowed attackers to inject malicious JavaScript into HTML chat exports via specially crafted bot messages.
• When a victim opened an affected HTML export, the hidden script could steal chat content, alter the displayed page, or phish for credentials.
• Telegram patched the vulnerability in Desktop Beta 6.9.4 and Stable 7.0.1, but older HTML export files remain vulnerable.

A significant security flaw in Telegram Desktop could have allowed malicious actors to compromise user data by embedding JavaScript within bot-generated inline keyboard buttons. This vulnerability, tracked as CVE-2023-34399, enabled the exfiltration of sensitive chat information when users exported their conversations as HTML files.

The issue has since been addressed by Telegram in Desktop Beta version 6.9.4 and Stable version 7.0.1. However, any HTML chat exports created using older, unpatched versions of the application may still pose a risk.

Discovery and Mechanism of the Flaw

The stored cross-site scripting (XSS) vulnerability was identified by security researchers Denis Rostilov and Aleksander Rostilov of ExPatch. Their findings revealed that Telegram Desktop’s HTML export feature improperly handled text within inline keyboard buttons generated by bots.

Telegram Desktop offers users the ability to export individual chats or their entire account history into HTML files. These files are typically used for archiving, legal compliance, or backup purposes and are opened locally in a web browser.

Prior to the security patch, the export function would directly insert the text from inline keyboard buttons into the generated HTML document without adequately escaping special characters. This oversight created an opportunity for attackers.

An attacker could craft a bot message containing malicious HTML, including script tags, within the label of an inline keyboard button. This payload could be made invisible using Unicode characters, making the button appear blank or harmless within the Telegram client itself.

How the Telegram Desktop Vulnerability Operated

While the Telegram desktop client displayed the malicious content as plain text, a web browser would interpret the same content as executable markup once the exported HTML file was opened. This distinction was crucial to the attack vector.

Exploitation of this vulnerability was not immediate upon receiving or viewing a message. Instead, several specific conditions had to be met: the chat history needed to contain a malicious message, the victim had to export that chat using a vulnerable Telegram Desktop version, and the exported HTML file had to be opened in a web browser with JavaScript enabled.

Upon successful execution, the hidden script could gain access to various data points rendered within the exported page. This included chat messages, sender identities, timestamps, group names, message metadata, and the complete visible text of the conversation. According to the researchers, this information could then be transmitted to an external server or used to manipulate the content displayed to the victim.

A particularly concerning aspect of this flaw was that a malicious bot did not need to be a direct member of the target group. An attacker could send a specially crafted bot message to another user, relying on that message being subsequently forwarded into a private group, public group, or supergroup.

Telegram’s forwarding mechanism preserves certain URL-based inline keyboard buttons, ensuring the malicious button text remained embedded within the forwarded message. This meant a malicious payload could lie dormant within a group’s history for extended periods, only activating when someone later exported the chat and opened the HTML archive. This created a delayed attack path with potential implications for compliance reviews, internal investigations, or legal evidence collection workflows.

The researchers further demonstrated that the injected code could entirely replace the export page with a convincing fake Telegram verification screen. Such DOM manipulation could be leveraged for sophisticated credential phishing schemes or to alter the visual presentation of chat records. It is important to note that while the attack could manipulate what a user saw in the browser-based export, it did not modify Telegram’s server-side messages.

The Patch and Affected Versions

Telegram addressed the vulnerability through commit 8457d13a, which implemented proper HTML escaping for inline keyboard button text. According to ExPatch, the fix was rolled out in Telegram Desktop Beta 6.9.4 on July 3, 2026, and subsequently in the stable release, version 7.0.1, on July 14, 2026. The vulnerable code was reportedly present since Telegram Desktop 4.15.1, released in March 2024.

What You Should Do

• Immediately update your Telegram Desktop application to version 7.0.1 or newer.
• Identify and replace any HTML chat exports created with Telegram Desktop versions prior to 7.0.1. Simply updating the application does not sanitize already generated files.
• Treat all older Telegram HTML exports as potentially compromised. If you must open them, do so with JavaScript explicitly disabled in your web browser, or regenerate them using a patched version of Telegram Desktop.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.