highclosedpatched
Telegram Desktop one-click account takeover via tg:// IPC (CVE-2026-107181)
› Telegram Desktop
Get an email when a new major security incident drops. No spam, unsubscribe any time.
- started
- Sep 16, 2026
- closed
- Sep 16, 2026
- CVEs
- 1
- sources
- 2
## summary
CVE-2026-107181 (CVSS 8.1) in Telegram Desktop before 7.2.9 lets a crafted tg:// link inject IPC commands and exfiltrate tdata session files, enabling account takeover without the password/2FA. Fixed in 7.2.9 (mid-September); continued discussion into early October.
severity: CVSS 8.1 (High)
## cve ids[1]
## affected
- Before 7.2.9
## fixed in
- 7.2.9+
## timeline[2]
Public write-ups and X discussion peak.
Telegram Desktop 7.2.9 ships the fix.
## advisories[1]
## news & write-ups[1]
## notes & caveats
Included as a recent developer-facing desktop issue; fewer high-quality X posts captured in this pass. Prefer the technical write-up over social chatter.
