logged in outlook , with “temporary allow this page” option from noscript. then potential XSS attack. c this:- (sorry old-mobile camera, cant take easy screen shots from qubes)
seeing how you are using both the browser version of telegram and the Whonix forum (obviously), is it possible that you have notifications activated on both of them? That can occasionally mess with the entire setup.