person

Aleksander Rostilov

Vulnerability researcher and co-author of ExPatch's published technical writeups on consumer software.

Current clusters

security2 publishers

Telegram Desktop exports made before July 14 still carry a bot's injected JavaScript

ExPatch says Telegram Desktop wrote bot button text into HTML chat exports without escaping it from March 2024 until a July fix, and updating the app leaves every file the earlier builds wrote unchanged on disk.

Publishers:securityaffairs.comthehackernews.com

Reality

Evidence65
Adoption40
Hype gap+15
Incentives55
Confidence62