📝 Show notes
CyberAware Daily — 2026-09-15
- Today's deep dive: a flaw in Telegram Desktop that lets hidden JavaScript in exported chat files pull out messages.
- What the flaw is and why it matters for people who use Telegram on a computer.
- Who's affected: mainly desktop users who use the export feature. If you've never exported, your risk is low.
- Practical steps: check for app updates, be wary of HTML files from others, and keep your own exports private.
- One action: open Telegram and check for any available updates, then install them.
More at https://cyberawareuk.co.uk
📄 Full transcript
Welcome to CyberAware UK, the daily podcast that helps British families stay safe from scams and
fraud. It's Tuesday and that means it's Threat Deep Dive Day. Right, so today we're going deep
on one type of scam. And our live intel has a story about Telegram desktop that feels like a
good one to dig into, because it's a bit unexpected. It is. So let's set the scene plainly,
Telegram is a messaging app similar to WhatsApp. It's used by millions of people around the world
and on desktop computers, it has a feature where you can export your chats.
Exporters in, you can download a copy of your conversations, maybe to keep a record or move
them somewhere else. And the export produces an HTML file, which is basically a web page you can
open in a browser. Now, researchers have found a flaw. This matters because when you export,
that HTML file can contain hidden JavaScript. JavaScript is code that runs inside a web page.
Normally, a file you export from a chat app shouldn't be running code. But according to the
researchers, hidden JavaScript in a Telegram export can quietly pull messages out and send them off.
So this is a real vulnerability in Telegram desktop. It's rated as significant and Telegram has been
notified. As far as we know, it's a flaw that needs the user to open an exported file.
Who does this affect? Mainly people who use Telegram desktop on Windows,
Mac or Linux, and who export their chat data. If you've never used the export feature,
your risk here is low. And if you have exported chats in the past, don't panic.
The issue is about opening malicious or tampered exports,
not about having a normal export sitting on your computer.
So what should people actually do? First, check for updates. Telegram regularly releases updates,
and if a fix is out, install it. Second, be careful with any HTML file you didn't create yourself.
That goes for exports from any messaging app, not just Telegram. If someone sends you a file that
looks like a chat export, treat it like a strange email attachment. And third, if you do export your
own chats, open the file locally and don't share it. It contains your conversations.
The bigger lesson here is that files that look like simple web pages can carry code.
So our one action for today is, open your app store or your Telegram settings and check for updates,
and install any that are waiting. That's simple enough. And while we're on the subject,
the other headline today is about something called confidential computing,
a security feature in some server chips. That's more of an enterprise story.
So we'll cover it another day if it matters for households.
Agreed. For now, stick to the basics. Update your apps, be cautious with unexpected files,
and you're doing the right thing.
We'll be back tomorrow with more practical advice. Stay safe, and we'll talk then.