Telegram’s Android Call Flaw: What We Know, What To Consider

🔍 Read the full analysis: Telegram’s Android Call Flaw: What We Know, What To Consider on ThorstenMeyerAI.com

Buying for a business?Offer from Amazon

Get business pricing on monitors, keyboards and dev gear

• Business-only prices and quantity discounts
• Tax-exempt purchasing
• Multiple users, one account, clear invoices

Create a free Business account →Free to register

As an affiliate, we earn on qualifying purchases.Hide

Security startup NebuSec disclosed a flaw in Telegram for Android on October 29, saying an attacker could use it as part of a chain of bugs to take control of a phone after the user answered a call. Telegram fixed the reported call-code issue in version 12.10.4, released in September, according to NebuSec; the company says it has not seen real-world attacks exploiting the chain.

NebuSec says the issue affected Telegram for Android versions 8.6.2 through 12.10.3, spanning March 2022 to September 2026. Its chief executive, Eten Zou, told The Hacker News that the call flaw alone was not enough to compromise a device. In NebuSec’s account, an attacker also needed a second bug to escape the app and a third vulnerability to gain Android root privileges, which provide administrator-level access.

The company says that, if the full chain worked, an attacker could access messages and use the phone’s microphone and camera. NebuSec said it tested the attack in private voice calls on ARM64 phones, a processor architecture used by most modern Android phones. Its short demonstration video shows a call connecting and the victim phone displaying a takeover message, but it does not identify the Telegram or Android versions used.

The precise technical details remain limited. As of October 29, NebuSec had not published a full research write-up, and the video does not independently establish how each stage of the claimed attack worked. The source report says Telegram acknowledged the disclosure, but Zou said the company did not believe the flaw could be used for remote code execution. The Hacker News sought Telegram comment; the source report said it found no public response.

Why Call Handling Can Expose Phones

The report matters because a Telegram call can arrive from someone the recipient does not know, and answering is an ordinary action rather than an obvious security decision. NebuSec characterizes the attack as one-click: the user must answer, so it is not described as a zero-click attack. If the company’s account is accurate, the call-handling flaw could serve as the entry point for more serious vulnerabilities.

For users, the immediate practical step is to install Telegram 12.10.4 or a later version and limit who can call them until they update. The issue also presents a tracking challenge for organizations: the source report says the flaw has no CVE identifier. Companies whose security processes rely only on CVE feeds may not see it, making app-version controls and clear workplace messaging policies relevant.

Products Worth Considering

Logitech MX Brio Ultra HD 4K Webcam, Graphite

AmazonView Latest Price

Samsung Galaxy Tab S10 FE 128GB Wi-Fi Android Tablet, Blue

AmazonView Latest Price

DJI Mic 3 Wireless Microphone System (2 Transmitters, 1 Receiver, Charging Case)

AmazonView Latest Price

As an affiliate, we earn on qualifying purchases.

The Fix Predates the Disclosure

The source report says Telegram was notified on September 26, shortly after version 12.10.4 appeared. Zou told The Hacker News that Telegram acknowledged the report but did not consider the bug exploitable as remote code execution; he also said no bounty was paid. The report found no public Telegram statement explaining the company’s assessment.

The report’s author compared Telegram’s public Android source code for versions 12.10.3 and 12.10.4. In the earlier version, the code checked that a camera-rotation value was present but then read a different field, video state, which did not have to be included in the message. In 12.10.4, the code reads the rotation field instead. That comparison supports the presence of a code change, but does not by itself verify NebuSec’s full exploit chain.

The source report also says Telegram’s shared call library received the correction on April 21, 2026, in a change titled “Fix camera rotation.” It reports that the iOS app incorporated the change in May and the desktop app in July. NebuSec has not shown that those platforms, or group calls, were directly affected. The report found no CVE entry or listing in the U.S. catalog of known exploited vulnerabilities as of October 29.

“Now picking up a wrong call can get you hacked.”

— NebuSec, in a post on X

What the Public Evidence Does Not Show

The full attack chain has not been publicly documented in a technical report, and the demonstration does not show the software versions involved. The source report’s code comparison identifies a change in Telegram’s call-handling code, but it does not verify the separate app-escape and root-exploit bugs described by NebuSec.

It is also unclear whether the chain works against a fully updated Android device, whether anyone exploited it before the disclosure, or whether older versions of Telegram on iOS or desktop could be affected. NebuSec says it has seen no real attacks; that is not proof that no such attacks occurred. The lack of a CVE and a listing in the U.S. known-exploited catalog does not, by itself, settle exploitability or past use.

Update Telegram and Watch for Details

Android users should update Telegram and check that the app is running version 12.10.4 or later. The source report recommends setting “Who can call me?” to “My Contacts” or “Nobody” until the app is updated, and declining calls from unknown accounts. Organizations can check installed app versions on work phones and set minimum-version requirements rather than relying only on vulnerability identifiers.

The next significant information would be a fuller technical account from NebuSec and a public explanation from Telegram of its assessment and fix. Until those details are available, the reported call-code defect and the broader claim of full phone compromise should be treated separately: the code change is described in the source report, while the complete attack chain remains based on NebuSec’s account.

Key Questions

What did NebuSec report?

NebuSec said a flaw in Telegram for Android’s call code could be combined with two other bugs to compromise a phone after the user answered a call. The company’s full technical explanation has not been published in the source material.

Which Telegram version contains the reported fix?

Telegram for Android 12.10.4 contains the reported correction. Users should update to that version or a later release.

Was this a zero-click attack?

No. NebuSec’s account requires the victim to answer an incoming call, so it is described as a one-click attack rather than a zero-click attack.

Are there confirmed real-world attacks?

NebuSec said it had seen no real-world attacks. The source report says there is no public evidence establishing whether the flaw was exploited before disclosure; absence of observed attacks does not prove that none occurred.

Are Telegram on iOS and desktop affected?

NebuSec has not shown that the iOS or desktop apps, or group calls, were directly affected. The source report says those apps received the shared call-code correction at different times, but whether their older code was exploitable has not been established.

Source: ThorstenMeyerAI.com