Security researchers at ExPatch published a writeup on September 12 describing a flaw in Telegram Desktop. According to their findings, a bot could plant hidden JavaScript inside chat messages that looked ordinary, complete with a link button, when viewed in the app.
The issue emerged when users exported chats to HTML files. The hidden script ran during that export process, potentially allowing message exfiltration from the exported data. The researchers said the script was able to exfiltrate messages from the HTML exports.
The report is the only source for this analysis, so there are no differing accounts to compare. The writeup does not indicate whether Telegram has issued a fix or when the flaw was introduced.