Tag: html-escaping

Auditing Telegram Desktop's HTML Export for Incomplete-Escaping XSS

A Telegram Desktop XSS flaw in its HTML export escaping logic let attackers exfiltrate entire chat histories, showing why desktop webview apps still inherit browser-grade attack surfaces.