Telegram Desktop Account Takeover PoC Disclosed
ID: c87cdaf4-b404-5bd5-b674-9109c9ea90a5
STIX ID: report--c87cdaf4-b404-5bd5-b674-9109c9ea90a5
Feed Name: securityonline.info
Threat Score
A high-severity vulnerability (CVE-2026-107181, CVSS 8.6) in Telegram Desktop (<7.2.9) allows attackers to exploit an IPC record-separator injection and the now-removed "interpret:" URI scheme to read local files and exfiltrate session keys via a single clicked link, enabling account takeover; proof-of-concept code was published and developers released an emergency patch in version 7.2.9—users should update immediately and apply mitigations if they cannot upgrade.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.