person

Denis Rostilov

Security researcher who works at ExPatch on flaws in messaging clients and other consumer desktop software.

Current clusters

security2 publishers

Telegram Desktop exports made before July 14 still carry a bot's injected JavaScript

ExPatch says Telegram Desktop wrote bot button text into HTML chat exports without escaping it from March 2024 until a July fix, and updating the app leaves every file the earlier builds wrote unchanged on disk.

Publishers:securityaffairs.comthehackernews.com

Reality

Evidence65
Adoption40
Hype gap+15
Incentives55
Confidence62