Telegram Desktop HTML Export Feature Enables Stored JS Injection

Tue, 15 Sep 2026 15:32:56 +0000

Engineer — Plan: If Telegram Desktop is used in your environment for work communications, advise users to stop using the HTML chat export feature until Telegram ships a fix; no patch version cited and no KEV/PoC, but the attack chain (malicious bot message → export → browser open) is realistic enough to warrant a policy change this quarter.
SOC/IR — Learn: Novel stored-JS-in-export technique is worth understanding for threat modeling chat-app abuse, but no IOCs, no ATT&CK mapping, and no evidence of active exploitation means there is no detection or hunt work to act on now.
Leader — Skip

Javascript-Injection on CuraSec