tl;dr: Telegram Desktop (through 7.2.8) had a vulnerability where clicked `tg://` links were passed between instances over a local socket using a semicolon-delimited format that wasn't escaped, allowing command injection. Attackers could chain this with the internal `interpret:` URI scheme—originally used for publishing releases—which reads arbitrary files and sends them to a chat without authorization checks, enabling exfiltration of session files and full account takeover. Fixed in 7.2.9 (CVE-2026-107181) by removing `interpret://` and properly escaping the socket protocol.