A public proof of concept has exposed a flaw in Telegram Desktop that could let attackers steal local files and take over accounts after a user clicks a crafted external link. Tracked as CVE-2026-107181, the vulnerability affects versions before 7.2.9 and carries a CVSS 4.0 severity rating of 8.6 (High). Researcher Beaksec published the technical write-up on October 3, 2026, and updated it on October 7. VulnCheck assigned the CVE that day. The reported attack reaches Telegram’s local session data, making account takeover possible when the victim has not enabled a local passcode. The weakness lies in how Telegram Desktop handles links opened outside the app. When Telegram is already running, another instance passes the link to it...
Read the full article at the source.
Comments (0)
No comments yet. Be the first to comment!