Telegram Desktop Flaw: What UK Families Need to Know

Telegram is a popular messaging app, and like any app, it's worth knowing when something goes wrong. Researchers have reported a flaw in Telegram Desktop that involves the export feature.

When you export chats from Telegram Desktop, the app creates an HTML file. That's basically a webpage you can open in a browser. The problem is that hidden JavaScript inside that file could run and quietly send your messages somewhere else. This isn't about someone guessing your password. It's about opening an exported file that has been tampered with.

Who is affected? Mainly people who use Telegram Desktop on Windows, Mac or Linux and who use the export feature. If you only use Telegram on your phone, or you've never exported chats, your risk is low. The vulnerability has been reported to Telegram, and a fix may already be available.

What should you do? First, check for updates. Open Telegram, go to settings, and install any updates that are waiting. Second, be cautious with HTML files you didn't create. If someone sends you a file that looks like a chat export, treat it like a suspicious email attachment. Third, if you export your own chats, keep the file private and don't share it.

The wider lesson is simple: files that look like web pages can carry code. So update your apps, think before you open unexpected files, and you're doing the right thing.

If messaging scams worry you more broadly, our guide to the WhatsApp code scam explains how account hijacks work, and AI voice cloning scams covers the calls that imitate a family member.

Stay safe.