How The Call Attack Concern Raises Questions About Telegram On Android

🔍 Read the full analysis: How The Call Attack Concern Raises Questions About Telegram On Android on ThorstenMeyerAI.com

Security startup NebuSec disclosed a flaw in Telegram for Android on October 29, saying an attacker could use it as part of a chain of three bugs to take control of a phone after the user answered a call. Telegram had already changed the relevant code in version 12.10.4, released in September, according to the report; NebuSec says it has not seen attacks in the wild.

NebuSec says the issue affected Telegram for Android versions 8.6.2 through 12.10.3. Its chief executive, Eten Zou, told The Hacker News that the call flaw alone was not enough to take over a device. The company says an attacker also needed a second bug to escape the app into Android and a third vulnerability that provided root access, or administrator-level control.

The alleged attack required the victim to answer an incoming call, making it a one-click attack rather than a zero-click attack. NebuSec says it confirmed the chain during private calls on ARM64 Android phones, a processor architecture used in most modern Android devices. It says an attacker needed only a regular Telegram account. The publicly shared 22-second demonstration shows a call connecting and the victim phone returning to its home screen, but does not identify the Telegram or Android versions shown.

The underlying call-code change can be seen in Telegram’s public Android source, according to the source material. In version 12.10.3, the code checked for one field in a call status message but read a different field that might be absent. Version 12.10.4 reads the field it checks. That code comparison supports the existence of a change; it does not independently establish that all three parts of NebuSec’s claimed attack chain work as described.

NebuSec says it reported the issue to Telegram on September 26, after the fixed Android version had appeared. Zou said Telegram acknowledged the report but did not think it could be used for remote code execution. According to Zou, no CVE identifier was assigned and no bounty was paid. The Hacker News sought comment from Telegram; the source material reports no public response.

Why Answering a Call Matters

The report focuses attention on a feature people routinely use without treating it as a security decision: answering an incoming call. If NebuSec’s account is accurate, an action that seems ordinary could have started a chain leading beyond Telegram to control of the phone. That could put private messages and access to the microphone or camera at risk, though the company’s full account has not been backed by a public technical write-up.

For individual users, the immediate practical issue is whether the app is current. NebuSec identifies version 12.10.4 as the fix; users can check their installed version in Telegram’s settings and update through the relevant app store or official distribution channel. Until updated, the source advises limiting who can call and declining calls from unknown accounts.

The disclosure also presents a challenge for organizations. Security systems that track only vulnerabilities with CVE identifiers may not flag a flaw that has no such record. Employers using Telegram on work phones may need to set minimum app versions and establish rules for messaging apps, rather than relying only on vulnerability feeds.

Popular right now

Bose QuietComfort Wireless Bluetooth Headphones with Active Noise Cancellation, Mic, USB‑C Charging, Deep Bass, 24‑Hour Battery – White Smok

AmazonView Latest Price

Bose QuietComfort Wireless Noise-Cancelling Over-Ear Headphones, Black

AmazonView Latest Price

Apple AirPods Pro 3 Wireless Earbuds

AmazonView Latest Price

As an affiliate, we earn on qualifying purchases.

The Fix Predates the Disclosure

NebuSec made its public disclosure on October 29, while Telegram’s Android version 12.10.4 was released in September. The source material says Telegram’s shared call library received a related correction on April 21, 2026, under a change titled “Fix camera rotation.” The Android source with the correction appeared later. That chronology suggests the relevant code was changed before NebuSec’s public announcement, but does not by itself show when Telegram understood the security implications.

Telegram’s shared call library is used across Android, iOS and desktop apps. The Hacker News, as cited in the source material, reported that iOS incorporated the change in May and desktop in July. NebuSec said it had no evidence that those platforms, or group calls, were directly affected. A shared code change is not proof that the same vulnerability was exploitable on each platform.

As of October 29, the source material reports no CVE listing for the flaw in the U.S. National Vulnerability Database and no Telegram entry in the CISA catalog of known exploited vulnerabilities cited there. Those absences describe the public records checked; they do not establish that exploitation never occurred.

„“Now picking up a wrong call can get you hacked.”“

— NebuSec, in its October 29 post on X

What the Public Evidence Shows

The central uncertainty is the full three-bug chain. NebuSec has described how the call flaw allegedly worked with two additional vulnerabilities, but the source material says its research page had no technical write-up as of October 29. The demo is brief and does not disclose the victim phone’s app or operating-system version. The additional bugs and the claimed path to root access therefore remain claims attributed to the company, not details readers can verify from the public demonstration alone.

It is also unclear whether the chain works on a fully updated Android phone, whether anyone used it before the disclosure, and whether any versions or platforms beyond those NebuSec named were affected. The company says it has seen no real-world attacks; that is not confirmation that no attack occurred. The absence of a CVE or a listing in an exploited-vulnerability catalog is also not proof that a flaw was harmless or unused.

The source material reports no public response from Telegram explaining why the code was changed, how the company assessed the security risk, or whether it investigated possible exploitation. It also does not provide independent confirmation of NebuSec’s private testing results.

Update and Await Technical Detail

Android users should check that Telegram is on version 12.10.4 or later, the version NebuSec identifies as containing the fix. Users who cannot update immediately can restrict incoming calls to contacts or disable calls, and avoid answering unexpected calls. These steps reduce exposure to the reported route but should not be treated as a substitute for installing the update.

Organizations with managed Android phones can check installed Telegram versions and set a minimum permitted version. They can also review whether their app-security process depends solely on CVE feeds, since this report had no CVE identifier as of the date cited.

The next useful evidence would be a detailed technical account from NebuSec, a public explanation from Telegram, or independent analysis of the claimed chain. Until then, the code correction and version number are more readily checkable than the reported full takeover scenario. The platforms, devices and real-world exploitation status remain unresolved.

Key Questions

What is the Telegram Android issue?

NebuSec reported a flaw in Telegram’s Android call code. It says the flaw could be combined with two other bugs to take control of a phone after the user answered a call.

Which Telegram version includes the fix?

NebuSec identifies Telegram for Android 12.10.4 as the fixed version. Users should check their installed version and update to that release or a later one.

Could an attacker take over a phone just by calling?

Not according to the account provided. NebuSec says the user had to answer the call and that the call flaw needed to be chained with two additional bugs. The full chain has not been documented publicly in the source material.

Were iPhone or desktop users affected?

NebuSec said it had no evidence that iOS or desktop apps were directly affected, and no evidence that group calls were affected. The source material says related shared call code was changed on those platforms, but that does not establish that the reported attack worked there.

Has the flaw been used in real attacks?

NebuSec says it has seen no real-world attacks. The source material reports no public CVE or CISA exploited-vulnerability listing as of October 29, 2026. Those points do not prove that the flaw was never exploited.

Source: ThorstenMeyerAI.com