One unescaped semicolon was enough to steal Telegram accounts
CVE-2026-107181 — a clicked link, an IPC separator nobody escaped, three files, and your session. Anatomy of an 8.1 whose fix shipped as a \"rendering fix\".
→ https://blog.slabb.dev/en/one-unescaped-semicolon-was-enough-to-steal-telegram-accounts
Journal de bordOne unescaped semicolon was enough to steal Telegram accountsCVE-2026-107181 — a clicked link, an IPC separator nobody escaped, three files, and your session. Anatomy of an 8.1 whose fix shipped as a \"rendering fix\".
commit 4b3345e