Critical Telegram Desktop Vulnerability: Update Before 7.2.9

Recently, a severe security vulnerability was discovered in the Telegram Desktop client. If you're using a version below 7.2.9, update as soon as possible. This flaw could allow an attacker to silently steal any file from your computer just by getting you to click a simple link.

What's the vulnerability about?

The vulnerability, tracked as CVE-2026-107181, affects all Telegram Desktop versions before 7.2.9. The issue lies in how the client handles tg:// protocol links. Because the separator ; isn't properly escaped, parameters in the link can be misinterpreted as separate IPC commands. Attackers can exploit the interpret: handler to craft a malicious link. When you click it, the client sends files from your system to an attacker-specified channel without your knowledge or any confirmation prompt.

Risks go beyond account theft

Many people might think this only leads to Telegram account hijacking, but the real risk is much greater. Attackers can steal any file you have permission to access on your computer, including documents, saved browser sessions, SSH keys, system configuration files, and even cryptocurrency wallets. In other words, one careless click could expose a large amount of sensitive data.

How to protect yourself

First, update your Telegram Desktop to version 7.2.9 or higher immediately. If you're using an unofficial client, switch back to the official client until a fix is available.

For users who can't update right away, there are a few temporary measures to reduce risk:

• When clicking any link, carefully check the confirmation window. If the link structure looks unusual, such as starting with tg://, don't proceed.
• Enable a local passcode lock in the client settings. This encrypts the session files in the tdata directory, so even if files leak, attackers can't easily take over your account.

Security updates are never a small matter. If you know anyone still using an old version of Telegram Desktop, remind them to upgrade soon.