The Desktop Client Trap: How a Semicolon Broke Telegram
AI-generated image · Bay Street Wire
A critical vulnerability in Telegram Desktop proves that 'secure' local apps are often just oversized attack surfaces waiting for a memory leak or a path traversal to compromise your filesystem.
For years, the industry has pushed the narrative that dedicated desktop clients are the gold standard for security and privacy. In reality, they are often bloated attack surfaces. As first reported by beaksec, a critical vulnerability in Telegram Desktop (CVE-2026-107181) allows for a one-click account takeover via IPC injection.
The flaw stems from how Telegram Desktop handles communication between multiple instances. When a user clicks a `tg://` link while Telegram is already running, the system launches a second process that sends the link as a text string to the running server process over a local socket.
The failure is improper input validation. Telegram used a custom serialization format where instructions are separated by semicolons but failed to escape this separator. By crafting a link containing a semicolon, an attacker can trick the running instance into deserializing a single URL as multiple distinct commands.
As beaksec discovered, this becomes catastrophic when paired with an internal URI scheme called `interpret:`. Originally designed for Telegram to publish its own releases, this scheme allows a script to specify a channel and a file to be sent. By injecting an `OPEN:interpret:` command, an attacker can read arbitrary files from the victim's local disk—including session files required for full account takeover—and exfiltrate them to an attacker-controlled chat without user confirmation.
This vulnerability affected Telegram Desktop through version 7.2.8 (confirmed on Windows version 6.9.3). The flaw was assigned a CVSS 3.1 severity score of 8.1 (High) and was fixed in version 7.2.9 (commit db3405699f).
**Opinion:** This is a textbook reminder of why the 'local app' model is a liability. We are trusting complex, privileged binaries to handle untrusted network data through fragile IPC mechanisms. When a single unescaped character can bridge the gap from a clicked link to a full filesystem read, the 'security' of the desktop client is an illusion.