Telegram asked us to stay silent about XSS. We are publishing anyway

Security researchers have discovered a critical XSS vulnerability in Telegram's HTML chat export feature. The flaw allowed attackers to compromise the privacy of correspondence via a specially crafted empty message. Although Telegram was notified of the issue, the company refused to coordinate a public disclosure and did not take steps to fix previously generated export files. The authors detail the technical causes of the vulnerability, share correspondence with the vendor, and explain why updating the app does not protect users who have already exported their data. Experts emphasize that old HTML exports remain dangerous as they contain malicious code that can be triggered when viewed in a browser. This case raises important questions about vendor transparency regarding security and responsibility for vulnerabilities in local user files.