A critical vulnerability in Telegram Desktop allowed attackers to steal arbitrary files from a user's computer by simply clicking a malicious link. The flaw exploited an unescaped separator within the application's single-instance IPC mechanism to read and exfiltrate sensitive data, including active session files.