Other cyber events · Report

One clicked link was able to give away your Telegram account. Update the computer app

A flaw in Telegram Desktop on computers let one clicked link copy your sign-in files. Telegram fixed it in September. Update the app on your computer.

By Phended · Published October 31, 2026 · Updated October 31, 2026

What happened

Telegram Desktop is the Telegram program for Windows, Mac, and Linux computers. This report is about that program.

Researchers found that one clicked link was able to send hidden commands to the running Telegram program.

The crafted link started with tg://, the part that Telegram links use. It worked when the link was opened in the computer's web browser.

The hidden commands copied files from the computer. The files went to a chat that the attacker controls.

The copied files included Telegram's own sign-in files.

With those files, someone was able to open your Telegram account. No password or two-step code was needed.

A security researcher reported the flaw through the Zero Day Initiative on June 25, 2026. Telegram fixed it on September 16.

Version 7.2.9 with the fix arrived on September 17, 2026. The version note mentioned only a rendering fix, so the fix was easy to miss.

The flaw received the number CVE-2026-107181. The researcher published the full details on October 3, 2026.

The tests were done on Windows. The researcher confirmed the attack on version 6.9.3 and listed versions up to 7.2.8 as affected.

Sources: Telegram Desktop: one-click account takeover via IPC injection; Remove legacy interpret path helper (the fix commit); Telegram Desktop release v7.2.9; CVE-2026-107181 incident summary

Who’s affected

This report concerns people who use the Telegram program on a computer, especially on Windows.

The attack needed several steps. Someone adds you to a Telegram group, and Telegram's default settings allow this without asking you.

The group holds small text files. Telegram saves them on your computer by itself when you open the group.

The group also holds a normal website link. When you click that link in your browser, the hidden commands run.

The hidden commands were able to copy any file on the computer. The researcher showed this with Telegram sign-in files, SSH keys, and browser password stores.

A person who uses Telegram only on a phone is not affected by this flaw. The tested program runs on computers.

Sources: Telegram Desktop: one-click account takeover via IPC injection

What to do

Open Telegram on your computer.
Open the menu, then Settings, then Advanced, then Application updates.
Click Check for updates. Install the update. Then restart Telegram.
Check the version number in the About window. It needs to be 7.2.9 or a later number.
Open Settings, then Devices. Sign out any device or session that you do not recognize.
Open Settings, then Privacy and Security, then Groups & Channels. Allow only your contacts to add you to groups.
In the same Privacy and Security section, set a local passcode.
A local passcode does not stop the copying. It makes the stolen files useless.
In Advanced settings, turn on the option that asks where to save each file before downloading.
Do not click links in group messages that you did not expect, even from people you know.
If you believe someone copied your files, tell the Telegram support team through the app.