GoKawiilTelegram Desktop flaw let a single link steal any local file, including login sessions
A security researcher found that Telegram Desktop's local inter-process communication, used to hand clicked links to an already-running instance, fails to escape its command separator character. This let a maliciously crafted tg:// link be split into multiple injected commands, one of which could trigger an internal scheme that reads a named file and sends it to a chat without asking the user for confirmation. The flaw, tracked as CVE-2026-107181 and rated 8.1/High, was confirmed on Windows up to version 6.9.3 and fixed in Telegram Desktop 7.2.9.