The vulnerability allows an attacker to inject malicious JavaScript code into a chat history file. When a victim uploads this file, the script executes in the victim's browser, potentially leading to data theft, session hijacking, malware distribution, and phishing attacks. The vulnerability is particularly dangerous because it leverages the trust users place in the chat application to execute harmful actions.

An attacker creates a malicious chat history file containing JavaScript code. The attacker then convinces a victim to upload this file to the chat application. Once uploaded, the malicious script executes in the victim's browser, allowing the attacker to steal sensitive information, hijack sessions, or distribute malware.

Users of the chat application who upload chat history files are affected. This includes any user who can be tricked into uploading a malicious file, potentially leading to the execution of harmful scripts in their browser.