A security researcher has discovered a reflected filename download vulnerability affecting the Instagram API that could be exploited to share malicious links. By exploiting a reflected file download bug, the attacker can post a link that points to a malicious file that once downloaded by the user appears to come from a legitimate Instagram domain without raising suspicion. The vulnerability works only with specific browsers (Chrome, Opera, Chrome for Android, the Android stock browser and Firefox) due to the presence of restriction for the Filename section”]
Source: http://securityaffairs.co/wordpress/35281/hacking/instagram-api-rfd-flaw.html