IntroductionSomeone adds you to a Telegram group. A link shows up in the chat. You click it, and your Telegram account is no longer only yours.How?Telegram Desktop hands clicked links to its own already-running instance over a local socket, as text, and never escapes the character it uses to separate commands. So a crafted link does not arrive as one instruction: it arrives as several.The chain I found has two defects. The first is that injection. The second is what the injected command reaches:...