importantSYS.SOURCE: The Hacker News• 2026-09-14T23:28:16+05:30

Telegram Desktop Vulnerability Allows Hidden JavaScript to Exfiltrate Messages from HTML Exports

#vulnerability #telegram #web security #data security #javascript

A vulnerability in Telegram Desktop allowed hidden JavaScript in HTML exports to exfiltrate messages from chats, with affected versions prior to July 2026 updates still posing risks for old exports. The flaw exploited unescaped inline keyboard buttons to execute scripts when opening exported files, requiring user updates to mitigate ongoing exposure.

A flaw in Telegram Desktop let a bot's message plant hidden JavaScript inside chats that users exported to HTML files, security researchers at ExPatch said in a writeup published on September 12.

In Telegram, the message looked ordinary, with a link button, and the script ran only when someone opened the export file in a web browser. It could then copy every message in that file to

Read original article

*** END OF TRANSMISSION ***

> OPENAI ACQUIRES GLASS IMAGING, A SMARTPHONE CAMERA TECH FIRM, FOR $300 MILLION > THE FUTURE OF MATHEMATICS IN THE AGE OF AI > CORNELIS SECURES $205M IN FUNDING TO CHALLENGE NVIDIA'S AI CHIP DOMINANCE > EVALUATING GPT-5.6 LUNA AND GPT-6 ASTRA FOR COST-EFFECTIVE CODE REVIEW > ORACLE INITIATES NEW LAYOFFS WITH EARLY-MORNING TERMINATION EMAILS AMID RESTRUCTURING > AMAZON PRIME VIDEO EXPANDS NEWS OFFERINGS WITH SHORT-FORM CLIPS TO COMPETE WITH TIKTOK > CLICKFIX CYBERATTACKS EXPLOIT MAC AND WINDOWS USERS THROUGH MALICIOUS TERMINAL COMMANDS > DDROP HARDWARE ATTACK EXPLOITS MEMORY ENCRYPTION FLAWS IN INTEL TDX AND AMD SEV-SNP > 3BB NETWORK COMPROMISED VIA MESHCENTRAL BACKDOOR FOR SUBSCRIBER CREDENTIAL THEFT > TELEGRAM DESKTOP VULNERABILITY ALLOWS HIDDEN JAVASCRIPT TO EXFILTRATE MESSAGES FROM HTML EXPORTS> OPENAI ACQUIRES GLASS IMAGING, A SMARTPHONE CAMERA TECH FIRM, FOR $300 MILLION > THE FUTURE OF MATHEMATICS IN THE AGE OF AI > CORNELIS SECURES $205M IN FUNDING TO CHALLENGE NVIDIA'S AI CHIP DOMINANCE > EVALUATING GPT-5.6 LUNA AND GPT-6 ASTRA FOR COST-EFFECTIVE CODE REVIEW > ORACLE INITIATES NEW LAYOFFS WITH EARLY-MORNING TERMINATION EMAILS AMID RESTRUCTURING > AMAZON PRIME VIDEO EXPANDS NEWS OFFERINGS WITH SHORT-FORM CLIPS TO COMPETE WITH TIKTOK > CLICKFIX CYBERATTACKS EXPLOIT MAC AND WINDOWS USERS THROUGH MALICIOUS TERMINAL COMMANDS > DDROP HARDWARE ATTACK EXPLOITS MEMORY ENCRYPTION FLAWS IN INTEL TDX AND AMD SEV-SNP > 3BB NETWORK COMPROMISED VIA MESHCENTRAL BACKDOOR FOR SUBSCRIBER CREDENTIAL THEFT > TELEGRAM DESKTOP VULNERABILITY ALLOWS HIDDEN JAVASCRIPT TO EXFILTRATE MESSAGES FROM HTML EXPORTS