If you use Telegram Desktop, update it now. A security flaw in versions before 7.2.9 lets an attacker hijack your account with a single click on a crafted link. The bug is tracked as CVE-2026-107181, it scores 8.6 out of 10 on the CVSS severity scale, and a working proof of concept is public. If you are running 7.2.9 or later and have a local passcode set, you are protected.
Here is what happened, how the attack actually works, and the exact steps to stay safe.
What happened
Security researcher BeakSec published a technical write-up in early October 2026 describing how two small defects in Telegram Desktop combine into a one-click account takeover. The flaws were reported privately through Zero Day Initiative back on June 25, 2026. Telegram fixed the issue independently on September 16 and shipped the patch in version 7.2.9 the next day.
The problem: the fix has been available for weeks, but many people do not update their desktop apps. Telegram Desktop does not force the update, and the vulnerability sat in the wild while users ran the affected versions. On October 7, VulnCheck assigned the flaw its CVE identifier, and the write-up was picked up by Hacker News the same week, which is why the story is circulating now.
Which versions are affected
Every version of Telegram Desktop from 6.9.3 through 7.2.8 is vulnerable, and the write-up confirms the issue persists through 7.2.8. The research was tested on Windows. Versions before 7.2.9 are all affected. Version 7.2.9, released September 17, 2026, contains the fix, and Telegram released version 7.3 on October 9 with the patch intact.
If you cannot remember the last time you updated Telegram Desktop, assume you are exposed and check your version before doing anything else.
How the attack works
The attack is clever because it chains two individually small mistakes into something serious. Understanding the chain also explains why the recommended defenses actually help.
Step 1: the unescaped separator
When you click a link outside Telegram while the app is already running, your operating system passes that link to the running Telegram process through a local channel called inter-process communication. Telegram Desktop flattens the link into a line of text, and it uses a raw semicolon as the record terminator on that channel without ever escaping it.
An attacker puts a semicolon inside a crafted tg:// link. Telegram then misreads the second half of the link as a brand-new command. That is the injection point.
Step 2: the forgotten internal tool
The injected command reaches interpret:, an old internal URI scheme left over from Telegram’s release-publishing tooling. This scheme was designed for trusted internal use only, but it never checked who was asking. Its job: read any file from the disk and send it to a chat, with no confirmation prompt.
So the attacker issues a command like OPEN:interpret: pointing at your Telegram session data, and Telegram obediently uploads it to the attacker’s channel.
Step 3: staging the files
Relative paths resolve from the Telegram data directory, which means the attacker cannot grab an arbitrary file by name, but they do not need to. Before sending the malicious link, the attacker adds the victim to a supergroup and posts a few small instruction text files. With Telegram’s default settings, group files auto-download into your Downloads folder, so the files land in a predictable spot.
Step 4: one click, session stolen
The attacker posts an ordinary https link that redirects to the stacked tg:// payload. You click it in your browser while Telegram is running. Three session files get lifted out of the tdata folder and uploaded to the attacker’s channel. If you have not set a local passcode (the default), those files let the attacker rebuild and import your authorized session on their own device. Your account is no longer only yours.
What the stolen files let attackers do
Your Telegram session files are the keys to your account. Anyone holding a copy can read your chats, impersonate you, contact your list, join your groups, and send messages as you. Because the session is fully authorized, it bypasses SMS-based two-step verification entirely.
An attacker with your session could also use it as a launchpad: phishing your contacts from your own account, or pulling files you have exchanged over the years. That is why account takeovers like this are so valuable to criminals, and why the fix matters even if you are not a high-profile target.
What to do right now
The good news is that protection is simple and takes about two minutes.
Update Telegram Desktop
Update to version 7.2.9 or newer. In Telegram Desktop, open Settings, go to Advanced, and check for updates, or download the latest build directly. The fix percent-escapes the record separator, removes the interpret scheme entirely, and blocks external URLs from being mixed with local file paths.
Set a local passcode
This is the single most important step besides updating. With a local passcode set, your session encryption key is derived from the passcode instead of an empty string, so stolen session files are useless to an attacker. In Telegram Desktop, open Settings, then Privacy and Security, and enable Local Passcode. Pick something strong.
Harden your settings
Three settings shrink the attack surface: restrict who can add you to group chats (Privacy and Security, then Groups and Channels), turn off automatic file downloads for groups and channels (Advanced, then Automatic Media Download), and stop automatic media downloads overall if you can live without them. Also treat unexpected group invites and shortened or redirecting links with suspicion.
Timeline of the disclosure
- June 25, 2026: BeakSec reports the flaw privately via Zero Day Initiative.
- September 16, 2026: Telegram removes the legacy interpret path helper in a code commit.
- September 17, 2026: Telegram Desktop 7.2.9 ships with the fix.
- October 3, 2026: the researcher publishes the public proof-of-concept write-up.
- October 7, 2026: VulnCheck assigns CVE-2026-107181; write-up updated.
- October 9, 2026: Telegram Desktop 7.3 released, fix intact.
As of mid-October, there is no evidence of active in-the-wild exploitation, and no network indicators have been published. But with a public proof of concept available, the window between now and your update is exactly the window that matters.
This is the same lesson as every recent desktop-app flaw: the patch exists, the exploit is public, and the only variable is whether you have installed it. If you want background on how attackers turn everyday software into entry points, see our explainers on the Tensorlake npm compromise and the KVM zero-day VM escape. For another recent case where timely patching was the whole story, read our Apple zero-day breakdown.
FAQ
Is Telegram Desktop 7.2.9 safe from this vulnerability?
Yes. Version 7.2.9, released September 17, 2026, contains the fix. Versions through 7.2.8 are vulnerable. If you are on 7.2.9 or the newer 7.3, you are protected from this specific flaw, but setting a local passcode is still recommended.
Does this affect Telegram on phones?
No. This flaw is specific to Telegram Desktop. The mobile apps use a different mechanism for handling links and were not affected.
Can attackers steal my account without me clicking anything?
No. The attack requires you to click a crafted link outside Telegram while the app is running. It also depends on default settings such as auto-download and open group-invite permissions. Staying on an updated version removes the risk entirely.
Does setting a local passcode really help?
Yes. Without a local passcode, your session key is effectively unprotected, so stolen session files can be reused directly. With a passcode set, the key is derived from it, and the stolen files give the attacker nothing usable.
Should I worry if I already clicked a suspicious link?
If you were on an affected version and clicked a suspicious link in a browser recently, update immediately, set a local passcode, then go to Settings, Active Sessions, and terminate any sessions you do not recognize. Consider that account potentially compromised and watch your contacts for messages you did not send.