The Telegram Export You Made Two Years Ago Could Still Be Handing Over Your Chats

Table of Contents

• It Wasn't a Hack—It Was a Feature Doing Exactly What It Was Told
• Two Ordinary Habits, One Dangerous Overlap
• The Root Cause: A Missing Filter
• From Silent Script to Fake Login Prompt
• Nothing Rare Had to Happen for This to Work
• Tracing the Bug Back to March 2024
• A Bounty Offer, Declined
• Patched, But Never Publicly Explained
• The Fix Doesn't Reach Backward
• Where Innovative Academy Fits In
• Final Word

If you ever exported a Telegram chat between March 2024 and mid-2026 and that conversation included a bot, there is a real chance the file sitting in your downloads folder right now could be more dangerous to open than you assume.

Security researchers Denis Rostilov and Aleksander Rostilov, working under the ExPatch banner, disclosed a vulnerability on September 12, 2026, that affected Telegram Desktop's chat export functionality. The flaw was rated 8.2 out of 10 for severity, although no official CVE number was assigned.

The vulnerability allowed malicious JavaScript to be embedded into exported Telegram chat histories through bot-generated inline keyboard content. When an affected HTML export was opened in a browser, that code could execute within the exported page.

1. It Wasn't a Hack—It Was a Feature Doing Exactly What It Was Told

There was no dramatic break-in, stolen password, or forced entry involved in the vulnerability.

Telegram Desktop's export feature was designed to convert conversations into HTML files that users could open and review in a browser. The security problem was what the export process allowed to pass through without properly neutralizing it.

Instead of treating all chat content as potentially untrusted data, the vulnerable export process could carry attacker-controlled script content directly into the generated HTML document.

That transformed a seemingly harmless backup file into something that could contain executable browser content.

2. Two Ordinary Habits, One Dangerous Overlap

Two completely normal Telegram behaviors combined to create the vulnerability.

• Telegram bots can send messages containing inline keyboard buttons and interactive elements.
• Users can export Telegram conversations as HTML files for backups, records, or offline access.

Neither activity is inherently dangerous by itself. The problem emerged when malicious content from a bot-controlled message was included in an HTML export without adequate filtering.

The result was a file that appeared to be a normal Telegram conversation but could contain executable JavaScript.

3. The Root Cause: A Missing Filter

The technical heart of the issue was insufficient filtering of content originating from inline keyboard buttons.

A malicious bot could place JavaScript content inside the text associated with an inline keyboard button. When Telegram Desktop generated an HTML export containing that message, the vulnerable versions failed to properly sanitize or neutralize the content.

The generated HTML could therefore contain attacker-controlled code.

Once the exported file was opened in a browser with JavaScript enabled, the browser could interpret that content as executable code rather than treating it strictly as harmless text.

This is a classic security lesson for developers: untrusted data must never be allowed to become executable content simply because it is being placed into an HTML document.

Understanding programming fundamentals and secure coding practices is therefore essential for anyone entering application development or cybersecurity. Innovative Academy's Python Training in Bangalore provides hands-on programming learning that can help students build a stronger foundation in application logic and secure development practices.

4. From Silent Script to Fake Login Prompt

When an affected export was opened in a browser, the injected script could execute in the context of the exported page.

According to the researchers' demonstration, the malicious code could access information contained within the exported conversation, including details such as:

• Chat messages
• Sender names
• Timestamps
• File paths represented in the export

The researchers also demonstrated how the page's visible content could be manipulated.

An attacker could potentially modify what the victim saw in the browser and create a convincing fake verification or login prompt. A user who trusted the exported file could then be tricked into entering sensitive credentials into the attacker-controlled interface.

This is one reason web security training increasingly focuses on understanding how browsers process untrusted input, rather than simply memorizing lists of vulnerabilities.

5. Nothing Rare Had to Happen for This to Work

The attack did not depend on an unusual chain of events.

Three relatively ordinary conditions were enough:

1. The Telegram export needed to have been generated using an affected version of Telegram Desktop.
2. The exported conversation needed to contain a bot message carrying the malicious content.
3. The resulting HTML file needed to be opened in a browser with JavaScript enabled.

That combination is important because Telegram bots are widely used and exporting conversations is a normal feature.

There was no requirement for the victim to install a suspicious executable or deliberately bypass a major security warning. The malicious content could simply remain inside a file that looked like an ordinary conversation archive.

6. Tracing the Bug Back to March 2024

The earliest affected release identified by the researchers was Telegram Desktop 4.15.1, released in March 2024.

The vulnerability reportedly remained present through version 6.9.3. A stable fix arrived with Telegram Desktop 7.0.1 on July 14, 2026.

That means the underlying weakness remained relevant for roughly two and a half years.

The important point for users is that updating Telegram Desktop today does not automatically change files that were exported before the vulnerability was fixed.

An old HTML export remains an old HTML export. If it contains malicious code, updating the application does not retroactively sanitize that file.

7. A Bounty Offer, Declined

The researchers reportedly notified Telegram about the vulnerability on June 3, 2026.

Telegram acknowledged the report on July 1 and offered a $500 bounty, which the researchers declined.

A code fix was introduced on June 30, reached the beta channel as version 6.9.4 on July 3, and was included in the stable 7.0.1 release on July 14.

The researchers waited until September 12 to publicly disclose their findings, giving users time to update to a fixed version.

The timeline demonstrates why coordinated vulnerability disclosure is important. Security researchers may discover a flaw months or even years after it was originally introduced, while vendors need time to investigate, develop, test, and distribute a fix.

8. Patched, But Never Publicly Explained

One of the notable aspects of the incident is that the security fix was not prominently explained to users.

The researchers reported that Telegram's release notes and changelog did not publicly identify the vulnerability as a security issue.

For security-conscious users, this creates an important visibility problem. Updating software is necessary, but users also need enough information to understand whether older data, backups, exports, or other generated files require additional attention.

A software update can close the vulnerability in the application while leaving previously generated artifacts untouched.

9. The Fix Doesn't Reach Backward

This is perhaps the most important practical lesson from the vulnerability.

Installing the latest Telegram Desktop version prevents new exports from being generated with the same vulnerability. However, an export created before the fix does not automatically become safe simply because the application has been updated.

Users who have older Telegram HTML exports should therefore treat them carefully, especially if they were created during the affected period.

A safer approach is to regenerate important exports using a current, patched version of Telegram Desktop rather than relying on an old HTML archive.

If an old export must be inspected, opening it in an environment where JavaScript is disabled can reduce the risk associated with executable page content. Users should also avoid entering passwords, authentication codes, or other sensitive information into unexpected prompts displayed by an exported conversation.

10. Where Innovative Academy Fits In

The vulnerability highlights a fundamental principle that applies far beyond Telegram: data supplied by users, bots, external systems, or third parties must be treated as untrusted until it has been safely processed.

Developers who understand how programming languages, web applications, browsers, authentication systems, and input handling work are better positioned to identify these types of security weaknesses.

Innovative Academy offers practical technology training designed around hands-on learning. Students interested in programming can explore the Python Training in Bangalore, while those looking to build broader cybersecurity skills can explore the Cybersecurity Training options available through Innovative Academy.

For students beginning their networking journey, the CCNA Training in Bangalore can provide foundational knowledge of networking concepts, while learners interested in Linux and cloud infrastructure can explore Linux Administration Training and AWS Training in Bangalore.

These areas increasingly overlap in modern IT environments, where developers, network engineers, cloud professionals, DevOps teams, and cybersecurity specialists all play a role in protecting applications and infrastructure.

11. Final Word

The mechanism behind this Telegram vulnerability is not a new category of attack. Cross-site scripting and the dangers of allowing untrusted content into browser-executable contexts have been known for years.

What makes this incident particularly interesting is the combination of a mainstream messaging platform, an ordinary export feature, bot-generated content, and a vulnerability that remained relevant for roughly two and a half years.

It also demonstrates an important distinction in cybersecurity: patching the software does not necessarily repair the files that software created while it was vulnerable.

For developers and security professionals, the lessons are straightforward:

• Treat external and user-generated content as untrusted.
• Sanitize and encode data before placing it into browser-rendered content.
• Never assume that a seemingly harmless feature cannot become a security boundary.
• Review previously generated files when a vulnerability affects an export or backup function.
• Keep applications updated and regenerate sensitive exports when necessary.
• Be suspicious of unexpected login, verification, or credential prompts inside locally stored HTML files.

The Telegram case is a useful reminder that security vulnerabilities do not always require an attacker to break into a system. Sometimes, the dangerous behavior is already built into a legitimate feature—and the attacker simply finds a way to make that feature work against the person using it.