Reported by 4 outlets
Telegram Desktop CVE-2026-107181 Account Takeover
Why this score
- Breadth
- 2.00 / 2.0 · 4 sources
- Authority
- 1.00 / 2.0 · best outlet weight
- Severity
- 3.70 / 5.0 · CVSS + content signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.41 / 0.6 · time to second source
- Recency
- × 0.08 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.6 / 10 = base × recency + community
Desk analysis
BeakSec disclosed CVE-2026-107181 (CVSS 8.1), a one-click account takeover in Telegram Desktop affecting versions before 7.2.9. The flaw is in the single-instance IPC mechanism: the app passes clicked tg:// links to an already-running instance without escaping its ";" separator, so a crafted link injects additional IPC commands. Chaining that injection with legacy URL handling lets an attacker trigger an OPEN command and read arbitrary files from disk, steal the user's session, and take over the account.
Why it matters: exploitation needs only one click on a malicious tg:// link, the kind of link that circulates routinely in Telegram channels and chats, and public PoC details are already available. A stolen session is full account compromise on the desktop client, including message history access and the ability to pivot into any group or channel the victim moderates. The arbitrary file read also exposes anything on disk the user can access.
Watch whether Telegram ships 7.2.9 or later to all desktop platforms and how quickly usage shifts, whether the flaw is assessed against the mobile clients that share the tg:// scheme, and for reports of in-the-wild use now that the technique is documented. Defenders should treat update-to-7.2.9 as urgent and be suspicious of tg:// links from unknown senders until patched.
Timeline
-
original reporting
A critical Telegram Desktop account takeover vulnerability (CVE-2026-107181) exposes users to session hijacking. Exploit details and PoC are
securityonline.info · 5d ago · October 9th, 2026
A critical Telegram Desktop account takeover vulnerability (CVE-2026-107181) exposes users to session hijacking. Exploit details and PoC are
via Mastodon https://securityonline.info/telegram-desktop-account-takeover-poc/?utm_source=mastodon&utm_medium=jetpack_social
-
update from beaksec.github.io
Telegram Desktop: one-click account takeover via IPC injection https://beaksec.github.io/posts/telegram-desktop-one-click-account-takeover/
beaksec.github.io · 4d ago · October 9th, 2026
Telegram Desktop: one-click account takeover via IPC injection https://beaksec.github.io/posts/telegram-desktop-one-click-account-takeover/
via Mastodon https://beaksec.github.io/posts/telegram-desktop-one-click-account-takeover/
-
update from beaksec.github.io
Telegram Desktop vulnerability allowed any user's file to be stolen https://beaksec.github.io/posts/telegram-desktop-one-click-account-takeo
beaksec.github.io · 4d ago · October 10th, 2026
Telegram Desktop vulnerability allowed any user's file to be stolen https://beaksec.github.io/posts/telegram-desktop-one-click-account-takeo
via Mastodon https://beaksec.github.io/posts/telegram-desktop-one-click-account-takeover/
-
mentioned by beaksec.github.io
Telegram Desktop vulnerability allowed any user's file to be stolen https:// beaksec.github.io/posts/telegr am-desktop-one-click-account-tak
beaksec.github.io · 4d ago · October 10th, 2026
-
update from thecybersecguru.com
🚨 A single click could be enough to hijack a Telegram Desktop account. CVE-2026-107181 reportedly chains IPC command injection with a legacy
thecybersecguru.com · 3d ago · October 10th, 2026
🚨 A single click could be enough to hijack a Telegram Desktop account. CVE-2026-107181 reportedly chains IPC command injection with a legacy
via Mastodon https://thecybersecguru.com/exploits/telegram-desktop-cve-2026-107181/
-
mentioned by thecybersecguru.com
🚨 TELEGRAM DESKTOP: ONE CLICK. FULL ACCOUNT TAKEOVER. Full technical breakdown 👉 https:// thecybersecguru.com/exploits/t elegram-desktop-cve
thecybersecguru.com · 3d ago · October 10th, 2026
-
update from beaksec.github.io
🤖 Telegram Desktop: an unescaped separator in the single-instance IPC lets one clicked link read arbitrary files off disk and exfiltrate the
beaksec.github.io · 3d ago · October 10th, 2026
🤖 Telegram Desktop: an unescaped separator in the single-instance IPC lets one clicked link read arbitrary files off disk and exfiltrate the
via Mastodon https://beaksec.github.io/posts/telegram-desktop-one-click-account-takeover/
-
update from zyvop.com
🚀 How a Single Link Could Steal Your Telegram Desktop Session Telegram Desktop before 7.2.9 passed clicked links to its running instance wit
zyvop.com · 3d ago · October 10th, 2026
🚀 How a Single Link Could Steal Your Telegram Desktop Session Telegram Desktop before 7.2.9 passed clicked links to its running instance wit
via Mastodon https://zyvop.com/how-a-single-link-could-steal-your-telegram-desktop-session-69xnx?utm_source=mastodon&utm_medium=social&utm_campaign=crosspost
-
mentioned by beaksec.github.io
🤖 CVE-2026-107181 (CVSS 8.1): Telegram Desktop's single-instance IPC fails to escape its ';' separator. A crafted tg:// link injects an OPEN
beaksec.github.io · 3d ago · October 10th, 2026
-
mentioned by beaksec.github.io
🪤 Telegram Desktop: one-click account takeover via IPC injection https:// beaksec.github.io/posts/telegr am-desktop-one-click-account-takeov
beaksec.github.io · 2d ago · October 11th, 2026