# Telegram Desktop: one-click account takeover via IPC injection

**URL:** <https://forum.devtalk.com/t/telegram-desktop-one-click-account-takeover-via-ipc-injection/250568>\
**Category:** In The News\
**Tags:** via-news-bot, desktop, telegram, in-the-news\
**Created:** [10 October 2026 16:46 UTC](https://forum.devtalk.com/t/telegram-desktop-one-click-account-takeover-via-ipc-injection/250568 "2026-10-10T16:46:37Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![CommunityNews](https://forum.devtalk.com/user_avatar/forum.devtalk.com/communitynews/32/1113_2.png) [@CommunityNews](https://forum.devtalk.com/u/CommunityNews)\
**Post date:** [10 October 2026 16:46 UTC](https://forum.devtalk.com/t/telegram-desktop-one-click-account-takeover-via-ipc-injection/250568/1 "2026-10-10T16:46:38Z")

</div>

> An unescaped separator in Telegram Desktop’s single-instance IPC lets one clicked link read arbitrary files off the disk and send them to the attacker, session files included.

Read in full here:

> **[Telegram Desktop: one-click account takeover via IPC injection](https://beaksec.github.io/posts/telegram-desktop-one-click-account-takeover/)**
>
> An unescaped separator in Telegram Desktop’s single-instance IPC lets one clicked link read arbitrary files off the disk and send them to the attacker, session files included.