← Back to context

Comment by g-b-r

14 hours ago

None, I'm not sure what the other user was talking about

Telegram wanting to be single instance means that it has to use some serialization, and it not escaping semicolons enables a part of the attack.

4 comments

g-b-r

Reply
lxgr  14 hours ago

What does "being single instance" mean here?

  • g-b-r  14 hours ago

    That only one instance of Telegram can run at any time.

    And if you open a Telegram link it will open in the existing instance.

    Windows uri handlers actually always create a new process, though; so if you want this single instance behavior, you have to do some check at the start of the process and communicate the uri to the previously running process (as explained in the article).

iririririr  5 hours ago

> not sure

so why answer?

  • g-b-r  2 hours ago

    Because I do know what this vulnerability was about, and it had nothing to do with Firefox (and I know that you specifically probably didn't mean that Firefox was involved, but even Telegram's desire to be single instance was not what caused the vulnerability).