x.comthreadDark Web Informer (@DarkWebInformer) on X
Social post announcing a PoC for CVE-2026-107181 in Telegram Desktop before 7.2.9. A crafted tg:// link abuses Telegram's IPC handler to exfiltrate local files, including session keys, which lets an attacker hijack the account without the password. Rated CVSS 8.1 (v3.1) / 8.6 (v4.0), fixed in 7.2.9, with a linked writeup on beaksec.github.io.
TL;DR PoC for Telegram Desktop <7.2.9 (CVE-2026-107181): malicious tg:// link triggers IPC file exfiltration, enabling session theft and account takeover.
Organisations named here
- tg:// URI handler
CVEs named here
- CVE-2026-107181
Technologies named here
- Telegram Desktop before 7.2.9
- Telegram
- CVSS
Techniques named here
- CVSS
- Session Hijacking
Related in AppSec
github.comadvisoryFlowise MCP Security Bypass Enables RCE
huntress.comwriteupInside an Oracle Database SQL Injection Attack | Huntress
github.comrepoOASIS
blog.trailofbits.comwriteup