How?

> Every program which has telemetry can

I'd go out on a limb here perhaps, but I'd claim that if your telemetry means that the one SENDING the data gets a RCE by default by it, you're doing telemetry very wrong. Maybe look into different libraries/services than the ones you use today, please.

But only these 2, only software with telemetry and web browsers. There are no RCEs in anything else…

Citation required for extraordinary claim.

While I understand your phrasing getting downvoted, I agree with what I assume you mean:

1. Telemetry as implemented is usually sloppy. Even though intuitively one could think that telemetry means “data gets collected locally and fired off to a remote server”, we have seen time and time again that they also build a return path to make the telemetry gathering more powerful. That return path can be a vector.

2. Web browsers have a _huge_ surface and they connect to remote servers constantly. The industry does very well at being proactive and at addressing CVEs but the whole premise makes that very difficult and so we cannot absolutely claim that browsers don’t have RCE(s).

[delayed]

[delayed]

Right, so you have the first step of something, but then depending on everything else, this is either a DOS or a RCE.

I'm claiming if "everything else" does indeed lead to a RCE, you're again doing something very wrong here. It's not rocket science exactly.

[delayed]

I'm sorry, but I still find it hard to believe you work with other professionals that when they implement telemetry in client applications, that usually ends up exposing a RCE on the client because of the telemetry implementation.