High severity8.1NVD Advisory· Published Dec 24, 2018· Updated Jun 17, 2026

CVE-2018-20436

Description

The "secret chat" feature in Telegram 4.9.1 for Android has a "side channel" in which Telegram servers send GET requests for URLs typed while composing a chat message, before that chat message is sent. There are also GET requests to other URLs on the same web server. This also affects one or more other Telegram products, such as Telegram Web-version 0.7.0. In addition, it can be interpreted as an SSRF issue. NOTE: a third party has reported that potentially unwanted behavior is caused by misconfiguration of the "Secret chats > Preview links" setting

Affected products

Telegramdesktop/Telegram Webllm-create
Range: =0.7.0
Telegramdesktop/Telegram for Androidllm-create
Range: =4.9.1

Patches

Vulnerability mechanics

References

misteralfa-hack.blogspot.com/2018/12/abusando-de-telegram-para-conseguir-una.htmlnvdExploitThird Party Advisory
misteralfa-hack.blogspot.com/2018/12/telegram-siempre-in-middle.htmlnvdExploitThird Party Advisory

News mentions

No linked articles in our index yet.

cvss	0.526
epss	0.001
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000