PoC Released for Telegram Desktop Flaw Enabling One

Cybersecuritynews •Abinaya • October 9, 2026

A public proof of concept has exposed a flaw in Telegram Desktop that could let attackers steal local files and take over accounts after a user clicks a crafted external link. Tracked as CVE-2026-107181, the vulnerability affects versions before 7.2.9 and carries a CVSS 4.0 severity rating of 8.6 (High). Researcher Beaksec published the technical […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Telegram Desktop Vulnerability Allows Account Takeover via Malicious Links A high-severity vulnerability in Telegram Desktop versions prior to 7.2.9 allows attackers to hijack user accounts by exploiting crafted tg:// links. Discovered by BeakSec, the flaw, tracked as CVE-2026-107181, enables command injection that can read and exfiltrate session files without user confirmation. Users clicking on malicious links in Telegram groups risk losing control of their accounts, especially if they do not have a local passcode set. The vulnerability was reported on June 25, 2026, and patched on September 17, 2026, but the first public proof of concept was released on October 10, 2026. Telegram has since urged users to update to the latest version to mitigate risks. No confirmed cases of exploitation have been reported yet. 6 sources 71

Extracted Entities

PoC Released for Telegram Desktop Flaw Enabling One

The full story

Extracted Entities

Attack Types (1)

CVEs (1)

MITRE ATT&CK (1)

Platforms (1)