A critical Telegram Desktop vulnerability could steal any local file; fixed in version 7.2.9
Ever chat on Telegram and wonder if simply clicking a web link could secretly empty your computer of its files?
This critical Telegram Desktop vulnerability is pretty insidious. Hackers can exploit a flaw in how the client handles external requests. All they have to do is trick you into clicking a specially crafted link in your browser, and they can use Telegram's permissions to steal sensitive local files and session keys—even bypassing two-step verification.
Here are a few thoughts:
Cross-app activation is a major security blind spot
People usually watch out for dangerous files sent in chat, but overlook the process of a website launching a desktop app directly through a system protocol. Many developers simply haven't put robust security boundaries in place for this kind of cross-app interaction.
Stealing credentials is more appealing to hackers than taking over your computer
Hackers are getting more pragmatic. Gaining the highest level of access to your computer takes too much effort; stealing your account credentials is easier. With your session key, they can log in to your account whenever they want—quietly and efficiently.
Next, hackers will probably take a closer look at other apps launched through custom protocols, such as Discord and Slack.
How can you protect yourself?
▶️ Update the app to version 7.2.9 or later right away
▶️ Turn off Telegram's automatic downloads
▶️ When your browser asks whether to “Allow opening an external application,” always decline unless you initiated the action yourself
Ever chat on Telegram and wonder if simply clicking a web link could secretly empty your computer of its files?
This critical Telegram Desktop vulnerability is pretty insidious. Hackers can exploit a flaw in how the client handles external requests. All they have to do is trick you into clicking a specially crafted link in your browser, and they can use Telegram's permissions to steal sensitive local files and session keys—even bypassing two-step verification.
Here are a few thoughts:
Cross-app activation is a major security blind spot
People usually watch out for dangerous files sent in chat, but overlook the process of a website launching a desktop app directly through a system protocol. Many developers simply haven't put robust security boundaries in place for this kind of cross-app interaction.
Stealing credentials is more appealing to hackers than taking over your computer
Hackers are getting more pragmatic. Gaining the highest level of access to your computer takes too much effort; stealing your account credentials is easier. With your session key, they can log in to your account whenever they want—quietly and efficiently.
Next, hackers will probably take a closer look at other apps launched through custom protocols, such as Discord and Slack.
How can you protect yourself?
▶️ Update the app to version 7.2.9 or later right away
▶️ Turn off Telegram's automatic downloads
▶️ When your browser asks whether to “Allow opening an external application,” always decline unless you initiated the action yourself