Telegram On Android: What To Know When A Call May Be The Attack

🔍 Read the full analysis: Telegram On Android: What To Know When A Call May Be The Attack on ThorstenMeyerAI.com

Before you orderOffer from Amazon

Get the latest gadgets delivered free with Prime

• Fast, free delivery on millions of items
• Prime Video, Amazon Music and more included
• Member-only deals all year

Start your free Prime trial →Free trial for eligible customers · Cancel anytime

As an affiliate, we earn on qualifying purchases.Hide

Security startup NebuSec disclosed a flaw in Telegram’s Android call code on October 29, saying it could be combined with two other bugs to give an attacker control of a phone after a user answers an incoming call. Telegram had already included a code change addressing the reported flaw in Android version 12.10.4, released in September, but the full attack chain has not been publicly documented.

NebuSec says the flaw affected Telegram for Android versions 8.6.2 through 12.10.3, spanning March 2022 to September 2026. According to the company’s chief executive, Eten Zou, the call-code bug alone was not enough to take over a device. It allegedly had to be combined with a second bug that leaked information and a third bug that provided Android root access, or administrator-level control.

Zou told The Hacker News that NebuSec tested the chain in private voice calls on ARM64 phones, a processor architecture used by most modern Android phones. The company said an attacker needed an ordinary Telegram account. Its short demonstration video shows a call connecting and the victim phone returning to its home screen, but does not identify the software versions used or provide a technical explanation of the full chain.

A review of Telegram’s publicly available Android source code found that the call-related code changed between versions 12.10.3 and 12.10.4. In the older code, a message’s rotation field was checked, but a different field was read; the newer code reads the rotation field. NebuSec reported the issue to Telegram on September 26, according to Zou. He said Telegram acknowledged the report but did not consider the flaw capable of enabling remote code execution. No CVE identifier was assigned, and Zou said NebuSec received no bounty.

Why Answered Calls Matter

The report concerns a point where users may have little reason to expect risk: answering a call in a messaging app. NebuSec’s account describes a one-click attack, because the recipient must answer; it is not a zero-click attack that works without any user action. The distinction matters when judging the claim and deciding how to respond.

If the company’s description is accurate, the issue could affect people who leave older Android app versions installed, as well as organizations whose device policies do not require prompt updates. NebuSec says the reported chain could expose messages, microphone and camera after the additional bugs provide access. Those outcomes are claims about the combined chain, not effects established by the publicly available code change alone.

For users, updating Telegram on Android to 12.10.4 or later is the clearest practical step in the source material. Until updated, the report recommends limiting incoming calls to contacts or nobody and declining calls from unknown people. The absence of a CVE also means organizations that rely only on CVE feeds may not see this report in their usual vulnerability tracking, making app-version controls relevant.

Products Worth Considering

Bose QuietComfort Wireless Bluetooth Headphones with Active Noise Cancellation, Mic, USB‑C Charging, Deep Bass, 24‑Hour Battery – White Smok

AmazonView Latest Price

Amazon Kindle Scribe Colorsoft 64GB (1st Generation)

AmazonView Latest Price

Apple Watch SE 3 GPS 44mm Smartwatch

AmazonView Latest Price

As an affiliate, we earn on qualifying purchases.

The Fix Predates the Disclosure

The timeline is central to understanding the report. Telegram Android version 12.10.4 appeared on September 24, while NebuSec says it reported the flaw two days later. Telegram’s shared call library, tgcalls, received a similar correction on April 21 in a change titled “Fix camera rotation,” according to the source material’s review of public code. The Android source carrying the correction appeared later.

The source material also reports that The Hacker News said the iOS app received the change in May and the desktop app in July. NebuSec has not shown that those versions were exploitable, and the company reportedly had no evidence that iOS, desktop or group calls were directly affected. A matching code change is evidence that code was corrected; by itself, it does not establish that every platform had the same security impact.

As of October 29, the US National Vulnerability Database had no CVE entry for the flaw, and the US Cybersecurity and Infrastructure Security Agency’s known-exploited-vulnerabilities catalog, dated October 28, had no Telegram entry, according to the source material. Those absences do not establish that an attack never occurred. NebuSec says it has seen no real-world attacks, but that is the company’s assessment.

“Now picking up a wrong call can get you hacked.”

— NebuSec, in its October 29 post on X

What the Public Evidence Shows

The full attack chain remains unverified in public technical detail. The source material says NebuSec had not published a technical write-up as of October 29. The demo video does not show the Telegram or Android versions on the victim device, and the other two alleged bugs have not been independently checked in the material provided.

It is also not established whether the chain works on a current, fully patched Android phone, whether anyone exploited the flaw before its disclosure, or how the issue affects any platform beyond the Android call code described. NebuSec says it has not seen real attacks, but no observed attacks are not proof that none occurred. The source material reports no public Telegram statement in response to questions from The Hacker News.

Update Android and Watch for Details

Android users can check the Telegram version shown in the app’s Settings and update to version 12.10.4 or later. Those unable to update immediately can restrict who may call them and avoid answering calls from unknown accounts, as interim precautions described in the report. Organizations should check that managed phones meet a minimum Telegram version rather than relying solely on CVE alerts.

The next significant development would be a detailed technical account from NebuSec or a public response from Telegram that clarifies the scope, affected versions and status of the other bugs. Until that information appears, the code correction and the company’s claims should be treated separately: the correction is visible in public source code, while the claimed full-device takeover depends on a chain that has not been publicly reproduced in detail.

Key Questions

Does answering a Telegram call automatically hack an Android phone?

No. NebuSec says an attacker would need to combine the call-code flaw with two additional bugs to gain control. The public material provided does not independently establish that full chain, and the report describes a potential attack rather than a confirmed infection from answering any call.

Which Telegram Android versions did NebuSec identify?

NebuSec identified versions 8.6.2 through 12.10.3 as affected and said the flaw was fixed in version 12.10.4. Users should check for a later available update and verify the version in Telegram’s Settings.

Has NebuSec reported real-world attacks?

NebuSec said it had seen no real-world attacks as of the October 29 disclosure. That is the company’s statement; the lack of observed cases does not establish that the flaw was never exploited.

Are Telegram on iPhone and desktop affected?

The source material says NebuSec had no evidence that iOS or desktop apps, or group calls, were directly affected. Similar code changes reportedly appeared in other apps, but the report does not establish exploitability on those platforms.

What should Telegram users do now?

Update Telegram for Android to 12.10.4 or later. If an update is not immediately available, limit incoming calls to contacts or nobody and decline calls from unfamiliar accounts while awaiting more information.

Source: ThorstenMeyerAI.com