One unescaped semicolon was enough to steal Telegram accounts

CVE-2026-107181 — a clicked link, an IPC separator nobody escaped, three files, and your session. Anatomy of an 8.1 whose fix shipped as a "rendering fix".