Telegram (v4.9.155353) was rendering file:// links + opening them via NSWorkspace.open -> code execution. - View it on GitHub