Telegram Desktop high-risk vulnerability can lead to account takeover: version 7.2.9 has been fixed
According to security researcher BeakSec, Telegram Desktop previously had a high-risk vulnerability CVE-2026-107181. Attackers could pre-place command files in the group where the victim is located, then induce them to click on links redirected through the browser, using inter-process communication command injection to send local files to a group controlled by the attacker; if the session file is stolen and the user has not set a local password, the account may be taken over.The researcher stated that versions 7.2.8 and earlier are affected, and the vulnerability has been fixed in version 7.2.9 released on September 17.
