Stored XSS in Telegram Desktop Allows Silent Data Exfiltration via Chat Export

Researchers from ExPatch Vulnerability Research have disclosed a stored cross-site scripting vulnerability in Telegram Desktop that allowed attackers to exfiltrate chat contents when users exported conversation history to HTML.

The issue was introduced in commit 52c779bf in early 2024 and shipped in stable release v4.15.1. The vulnerable code in export_output_html.cpp directly wrote button.text.toUtf8() into the generated HTML without escaping, while all other message fields were processed by SerializeString().

An attacker could create a bot that sent a single message containing an inline URL button whose text field held invisible Unicode characters followed by a