Telegram Desktop patches one-click account takeover in 7.2.9

What happened

A flaw in Telegram Desktop before version 7.2.9 lets a malicious link make the app upload local files, including session keys, to an attacker-controlled channel. Anyone who opens the link can lose their Telegram account. The fix shipped in version 7.2.9.

Why it matters

Any user who opens a crafted tg:// link can lose control of their Telegram account, exposing conversations and contacts. Exploitation requires only social engineering, with no local code execution, and could be automated by malicious sites, according to the sources. Severity is high (CVSS 8.6).

What to do

Update Telegram Desktop to version 7.2.9 or later on all machines. Tell users not to open tg:// links from unknown sources.

For the technical team

CVE

CVE-2026-107181

Affected

Telegram Desktop · Telegram Desktop before 7.2.9 (7.2.8 and earlier).

Exploitation

No in-the-wild exploitation reported in the sources; no KEV listing and EPSS unavailable. Technical write-up published by beaksec; sources describe exploitation as straightforward, feasible via social engineering and automatable by malicious sites.

Fix

Update to Telegram Desktop 7.2.9 or later.

Vector

IPC record-separator injection (CWE-143) in the Core::Sandbox component. Crafted tg:// links with unescaped semicolons inject OPEN: records and invoke the interpret: scheme handler, which can upload local files to an attacker-controlled channel. No local code execution required; remote exploitation via social engineering, and traffic to the interpret: handler is normally permitted.

More details

Documented in a beaksec write-up and on OpenCVE. CVSS 8.6. Targeted files include session keys in the tdata directory; with the session key, the attacker takes over the victim's account. Start date 2026-09-16 per the beaksec source.

Timeline

1. 10/26/2026 01:38 PM

   Incident opened.

Sources 2 sources

• beaksec write-up beaksec
• OpenCVE CVE-2026-107181 OpenCVE

See all news