Seems like a revive of: https://github.com/desktop-app/lib_webview/commit/77b1712a8f... (2022)

where you could open an app by running window.open("C:\Windows\system32\cmd.exe")

This is a guess based on the behavior in the video, and on the recent fix on Media Preview feature of "Instant View" attachments: https://github.com/telegramdesktop/tdesktop/commit/eaaa704fa... (3 days ago)

so potentially could be just to send an Instant View link pointing to an executable app instead of a website.

No one has confirmed the vulnerability, there is only a video showing the vuln, it is most likely fake.

Video: https://t.me/exploitorg/30?comment=31

If you’re using a fully-fledged OS for your secure comms (and using telegram off of a mobile device to start with), this probably isn’t your biggest threat.

Disabling of automatic media parsing as suggested is absolutely a wise choice.

This would be pretty bad indeed if it were wormable.