A critical security flaw in Telegram's official desktop client enables a stealthy attack where malicious scripts, hidden within chat messages, silently exfiltrate entire conversation histories. The vulnerability exploits the process of exporting chats to HTML files, creating a cross-application attack that bypasses the secure environment of the messaging app itself.
Discovered and detailed by security researchers ExPatch in a September 12 disclosure, the flaw resides in how Telegram Desktop renders HTML chat exports. An attacker could inject a seemingly benign message containing a specially crafted button. When a user followed the standard procedure to export a chat and then opened the resulting HTML file in a web browser, the embedded JavaScript within that message would execute.
Once running in the browser's context, the script gains access to the local HTML file's content, allowing it to read and send out the full chat history. The attack is notably stealthy because the malicious payload remains inert and invisible within Telegram; it only activates upon the user's routine action of viewing an export, turning a common backup or sharing task into the attack trigger.
As of this publication, Telegram has not released an official patch or public statement addressing the issue. This leaves all users of the desktop client who utilize the HTML export feature exposed to this attack vector, particularly concerning for organizations or individuals handling sensitive documentation, legal records, or confidential discussions.
The incident underscores a fundamental security principle: data protection must extend to all export and archival workflows, not just the primary application's encrypted transport. The integrity of an exported file cannot be assumed once it leaves the app's secure perimeter.
Users are advised to take immediate precautions. Avoid opening any recently created Telegram HTML chat exports in a web browser until a patch is confirmed. For essential access, only use a web browser equipped with a robust, pre-configured script-blocking extension. A more technical safeguard involves manually inspecting the HTML source code for unrecognized <script> tags or obfuscated JavaScript before rendering the page. All exported .html chat files should be treated as potentially untrusted data.
This vulnerability serves as a stark reminder to scrutinize the security of data even as it moves from a trusted application to a local file. Users and administrators should monitor Telegram for an official security update.
Telegram官方桌面用戶端存在一個嚴重的安全漏洞，容許進行靜默攻擊。攻擊者可將惡意腳本隱藏在聊天訊息中，在用戶匯出對話記錄時，靜默地竊取整個對話歷史。該漏洞利用了將對話匯出為HTML檔案的過程，形成一種跨應用程式攻擊，繞過了即時通訊應用程式本身的安全環境。
此漏洞由安全研究員ExPatch於9月12日披露並詳述，問題存在於Telegram桌面版渲染HTML格式對話匯出的方式。攻擊者可注入一條看似無害的訊息，其中包含一個特製按鈕。當用戶遵循標準程序匯出對話，並在瀏覽器中開啟產生的HTML檔案時，該訊息內嵌的JavaScript就會執行。
腳本一旦在瀏覽器環境中運行，便能存取本地HTML檔案的內容，從而讀取並傳送出完整的對話歷史。此攻擊方式極具隱蔽性，因為惡意載荷在Telegram內會保持休眠且不可見；只有在用戶執行查看匯出檔案的常規操作時才會啟動，將常見的備份或共享任務變為攻擊觸發點。
截至本文發佈，Telegram尚未發布官方補丁或公開聲明處理此問題。這意味著所有使用HTML匯出功能的桌面版用戶端用戶都面臨此攻擊向量的風險，對處理敏感文件、法律記錄或機密討論的組織或個人尤為值得關注。
此事件突顯了一個基本的安全原則：資料保護必須涵蓋所有匯出和存檔工作流程，而不僅僅是主應用程式的加密傳輸。一旦檔案離開應用程式的安全範圍，其完整性便不能被視為理所當然。
建議用戶立即採取預防措施。在確認補丁發布前，避免在網頁瀏覽器中開啟任何近期建立的Telegram HTML格式對話匯出檔案。如需存取，請僅使用配備有強大、預設腳本攔截功能的擴充功能的瀏覽器。更為技術性的防護措施包括，在載入頁面前手動檢查HTML原始碼中是否有無法識別的<script>標籤或混淆的JavaScript代碼。所有匯出的.html對話檔案都應被視為潛在不受信任的資料。
此漏洞是一個明確的提醒，即使資料從可信應用程式移動到本地檔案，用戶也必須審慎檢查其安全性。用戶和管理員應密切關注Telegram的官方安全更新。