Affected Systems
Telegram Desktop versions 4.15.1 (March 2024) through 6.9.3 on Windows, macOS, and Linux. Vulnerability affects HTML-exported chat files created with vulnerable versions. Fixed in 6.9.4 beta (July 3, 2026) and 7.0.1 stable (July 14, 2026).
Exploitation Status
No evidence of active exploitation. Researchers reported the flaw on June 3, 2026, tested only on their own accounts, and claim no public exploitation. No CVE assigned. Patch released July 2026.
Business Impact
Attackers could inject hidden JavaScript into bot message inline keyboard buttons that executes when users open HTML-exported chats in a browser. Script can exfiltrate all messages (up to 1,000 per file), sender names, timestamps, chat metadata, and local file paths to attacker-controlled servers. Can also rewrite displayed content for social engineering (e.g., fake verification forms) or evidence tampering. Attack vector requires bot message forwarded into target chat, export created with vulnerable version, and file opened with JavaScript enabled. Old exports remain vulnerable even after app update. CVSS 8.2 (researcher-assigned). No official Telegram advisory or CVE published as of September 14, 2026.
Urgency
🟡 Within a week
Recommended Actions
- Update Telegram Desktop to version 7.0.1 stable or 6.9.4 beta or later immediately
- Re-export all chats to HTML using the patched version; delete or quarantine HTML exports created before July 2026
- Open legacy HTML exports only with JavaScript disabled in browser settings, or avoid opening them entirely
- Treat HTML exports from large group chats as untrusted; verify message provenance before relying on exports as evidence or records
- Monitor for forwarded bot messages with empty or unusual inline keyboard buttons in sensitive group chats