pwn.watch: Telegram incident updates https://pwn.watch/t/telegram Live security incidents worldwide: CVEs, patch status, fixed versions, advisories and the posts that broke them. en Thu, 22 Oct 2026 09:20:00 GMT [high] Telegram Desktop one-click account takeover via tg:// IPC (CVE-2026-107181) https://pwn.watch/i/telegram-desktop-cve-2026-107181 https://pwn.watch/i/telegram-desktop-cve-2026-107181 Thu, 22 Oct 2026 09:20:00 GMT high <p>CVE-2026-107181 (CVSS 8.1) in Telegram Desktop before 7.2.9 lets a crafted tg:// link inject IPC commands and exfiltrate tdata session files, enabling account takeover without the password/2FA. Fixed in 7.2.9 (mid-September); continued discussion into early October.</p> <p><strong>Status:</strong> closed · <strong>Patch:</strong> patched · <strong>Fixed in:</strong> 7.2.9+</p> <p><strong>Latest updates:</strong></p><ul><li>2026-10-08/10: Public write-ups and X discussion peak.</li><li>2026-09-16: Telegram Desktop 7.2.9 ships the fix.</li></ul> <p><strong>CVEs:</strong> CVE-2026-107181</p>