Telegram Desktop Flaw Lets Hidden JavaScript Exfiltrate Messages From HTML Exports
Summary
A vulnerability in Telegram Desktop allowed a bot to embed hidden JavaScript within HTML exports of chat messages. This script would execute when a user opened the exported file in a web browser, enabling it to exfiltrate all messages from the file.
IFF Assessment
This vulnerability allows for the unauthorized exfiltration of sensitive chat data, posing a direct threat to user privacy and data security.
Severity
The vulnerability allows for unauthorized disclosure of sensitive information (messages) through a user-opened HTML file, with a relatively low attack complexity and no required privileges. The impact is significant for confidentiality.
Defender Context
This incident highlights the risks associated with rich text rendering and script execution in exported data formats. Defenders should be aware of how client-side vulnerabilities can be leveraged to exfiltrate sensitive information, especially in communication platforms. Organizations should advise users to exercise caution when opening exported chat logs from untrusted sources.