r/netsec • u/namanyayg • 1d ago

Telegram Desktop vulnerability allowed any user file to be stolen

https://beaksec.github.io/posts/telegram-desktop-one-click-account-takeover/
154 Upvotes

99% Upvoted

7 comments sorted by

16

u/mlgbcnmsl 1d ago

I found another zero-click RCE for Whatsapp

https://calif.io/research/the-great-glyph-grift

11

u/jangwao 1d ago

That's why OSX apps are sandboxed? Or that wouldn't help? In any case I would expect tg handler is sanitized

16

u/darthandroid 1d ago

Partially. A sandboxed Telegram would limit the attack to stealing telegram files themselves. It'll keep your user documents and stuff safe, but it won't keep your telegram session itself safe; It would still allow an attacker to log into your telegram account and take it over.

1

u/Yvette_glucose_6x19 9h ago

Is this true same as the issues now with discord