Diffbrief Engineering daily

← Saturday, October 10, 2026SecurityVulnerability

Telegram Desktop link handling enabled file theft through IPC injection

beaksec.github.io 12 min read Editor score 7/10

A crafted link injects commands through Telegram Desktop's local socket, then invokes an internal URI that reads and sends a file without checking authorization. The chain enabled arbitrary file theft and account takeover; version 7.2.9 fixes it.

What
A Telegram Desktop vulnerability let a crafted link inject commands through IPC and trigger an internal URI handler to read and send a local file.
How
The new process serialized links as text over a local socket; unescaped semicolons let the running instance parse injected instructions.
Why it matters
A clicked link could expose login files and enable account takeover; the excerpt says Telegram Desktop 7.2.9 fixed the issue.
send text deliver invoke read send new process local socket already-runninginstance interpret: file chat
A crafted link crosses Telegram's local-socket protocol and reaches the file-sending URI handler. Sketched from the article's own text.

Read on beaksec.github.io → Hacker News · 43 comments

Discussion

Discussion is not switched on yet. Use Note above to keep your own thoughts on this story.

Headline, summary, brief and diagram are written by a model from the source's own text; the link, byline and numbers come from the source. Read the original before relying on a claim.

Your note

Private to you. Stored in this browser, and synced to your account when you are signed in.