A Telegram Desktop flaw lets bots inject JavaScript into exported chats, enabling data theft and page manipulation.