CVE-2018-20436

The "secret chat" feature in Telegram 4.9.1 for Android has a "side channel" in which Telegram servers send GET requests for URLs typed while composing a chat message, before that chat message is sent. There are also GET requests to other URLs on the same web server. This also affects one or more other Telegram products, such as Telegram Web-version 0.7.0. In addition, it can be interpreted as an SSRF issue. NOTE: a third party has reported that potentially unwanted behavior is caused by misconfiguration of the "Secret chats > Preview links" setting

• CWE-918

• https://misteralfa-hack.blogspot.com/2018/12/abusando-de-telegram-para-conseguir-una.htmlExploit, Third Party Advisory
• https://misteralfa-hack.blogspot.com/2018/12/telegram-siempre-in-middle.htmlExploit, Third Party Advisory
• https://misteralfa-hack.blogspot.com/2018/12/abusando-de-telegram-para-conseguir-una.htmlExploit, Third Party Advisory
• https://misteralfa-hack.blogspot.com/2018/12/telegram-siempre-in-middle.htmlExploit, Third Party Advisory

Published

Dec 24, 2018

Last Modified

Jun 17, 2026

Status

Modified

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-2043Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2018-20430GNU Libextractor through 1.8 has an out-of-bounds read vulne…
• CVE-2018-20431GNU Libextractor through 1.8 has a NULL Pointer Dereference …
• CVE-2018-20432D-Link COVR-2600R and COVR-3902 Kit before 1.01b05Beta01 use…9.8
• CVE-2018-20433c3p0 0.9.5.2 allows XXE in extractXmlConfigFromInputStream i…
• CVE-2018-20434LibreNMS 1.46 allows remote attackers to execute arbitrary O…
• CVE-2018-20437An issue was discovered in the fileDownload function in the …7.5
• CVE-2018-20438Technicolor TC7110.AR STD3.38.03 devices allow remote attack…
• CVE-2018-20439Technicolor DPC3928SL D3928SL-PSIP-13-A010-c3420r55105-17021…
• CVE-2018-2044Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2018-20440Technicolor CWA0101 CWA0101E-A23E-c7000r5712-170315-SKC devi…
• CVE-2018-20441Technicolor TC7200.TH2v2 SC05.00.22 devices allow remote att…