The vulnerability carries a CVSS score of 8.1 for version 3.1 and 8.6 for version 4.0, and a proof-of-concept for the exploit is now public. Telegram has addressed the security hole in version 7.2.9, and users of the desktop application are urged to update immediately to prevent account compromise.
Wednesday, October 21, 2026
Story
Telegram Patches Flaw That Steals Desktop Session Keys
Cybersecurity11 days ago
Attackers can take over user profiles without passwords by tricking victims into clicking a tg:// link in the messaging app's PC client. The flaw, tracked as CVE-2026-107181, leverages the application's IPC handler to exfiltrate session keys and local computer files to an attacker's channel. This process occurs without requiring additional user confirmation, potentially giving an attacker full access to the hijacked account.
Looking for more context or analysis?
Tilt chat provides reliable, tailored insights, alerts, and automations.