Security researcher BeakSec disclosed that Telegram Desktop had a high-severity vulnerability, CVE-2026-107181, that could allow account takeover. According to ChainCatcher, attackers could place a command file in a victim’s group, lure the user to click a browser-redirected link, and use interprocess communication command injection to send local files to an attacker-controlled group.

If an attacker also obtained the session file and the user had not set a local password, the account could be taken over. BeakSec said versions 7.2.8 and earlier were affected, and the flaw was fixed in version 7.2.9 released on September 17.