beaksec chained two bugs in Telegram Desktop into a one-click account takeover (CVE-2026-107181, 8.1).
A second launch hands its tg:// link to the running instance over a local socket as OPEN:<url>;, nobody escaped the semicolon, and so a link redirected from an innocent-looking https URL arrives as several commands.
One of them reaches interpret:, a leftover release-publishing helper that reads whatever file an instruction file names and posts it to a channel, with no authorization check and no confirmation.
The instruction files get there by themselves: the attacker adds the victim to a group, posts them, and auto-download drops them at a predictable path, and with no local passcode set (the default) the stolen key_datas plus two session files are enough to open the account elsewhere.
Telegram fixed it in 7.2.9 on 16 September by deleting the helper outright, under a commit titled “Remove legacy interpret path helper” and a changelog that mentions only a rendering fix.
