[High-Risk Vulnerability in Telegram Desktop Could Lead to Account Takeover, Version 7.2.9 Fixed] According to security researcher BeakSec, a high-risk vulnerability, CVE-2026-107181, was previously present in Telegram Desktop. Attackers could pre-place command files in a group where the victim is a member, then lure them into clicking a browser-redirected link. By exploiting inter-process communication command injection, local files could be sent to a group controlled by the attacker. If session files were stolen and the user had not set a local password, the account could potentially be taken over. The researcher stated that versions 7.2.8 and earlier were affected, but the vulnerability was fixed in version 7.2.9, released on September 17.