Telegram Desktop Flaw Lets Hidden JavaScript Exfiltrate Messages From HTML Exports
More on JavaScript
Other advisories
- Not ratedosv:CLEANSTART-2026-WE07714Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web To...
- Not ratedosv:CLEANSTART-2026-WP21635Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web To...
- Not ratedosv:CLEANSTART-2026-OI48555Go JOSE provides an implementation of the Javascript Object Signing and Encryption set of standards in Go, including support for JSON Web Encryption (JWE), JSON Web Signature (JWS), and JSON Web To...
- Not ratedosv:CVE-2026-111048FOSSBilling: Low-privileged staff can run JavaScript in administrators' browsers via stored XSS in support ticket notes
- Not ratedosv:CLEANSTART-2024-CC28540When a JavaScript URL (javascript:) is evaluated and the result is a string, this string is parsed to create an HTML document, which is then presented
- Not ratedosv:CLEANSTART-2024-RS46855Due to confusion about ValueTags on JavaScript Objects, an object may pass through the type barrier, resulting in memory corruption and a potentially exploitable crash
- Not ratedosv:CLEANSTART-2024-WB34613Firefox sometimes ran the onload handler for SVG elements that the DOM sanitizer decided to remove, resulting in JavaScript being executed after pasting attacker-controlled data into a contentedita...
- Not ratedosv:CLEANSTART-2024-CK19682Due to improper handling of uploaded images it is possible in very unlikely and rare conditions to force the agents browser to execute malicious javascript from a special crafted SVG file rendered ...
Other news entries
- Polymarket halts trading after crypto-draining script breach, $2.5M tracedNewsBleepingComputer
- Fuzzers vs. AI: Comparing Fuzzilli and BigSleep on JavaScript EnginesNewsGoogle Project Zero
- Hackers Infect 953 Online Stores With Scanner-Evading JavaScript, Mostly on MagentoNewsThe Hacker News
- NCSC-2026-0436 [1.00] [M/H] Kwetsbaarheden verholpen in Adobe CommerceNewsNCSC-NL
- 100+ Compromised Websites Use Fake Cloudflare Checks to Deliver LunexStealerNewsThe Hacker News
- PamStealer macOS Malware Adds Live C2 Payload Decryption and Multi-Layer PersistenceNewsThe Hacker News
- New npm malware finds a way around install script defensesNewsCSO Online
- WeaselBiscuit Stealer Spreads via 13 npm Packages to Harvest Chrome Extension StorageNewsThe Hacker News
Source: https://thehackernews.com/2026/09/telegram-desktop-flaw-lets-hidden.html
ID