Telegram Android Security: Making Sense Of The Call Flaw

🔍 Read the full analysis: Telegram Android Security: Making Sense Of The Call Flaw on ThorstenMeyerAI.com

Before you orderOffer from Amazon

Get the latest gadgets delivered free with Prime

• Fast, free delivery on millions of items
• Prime Video, Amazon Music and more included
• Member-only deals all year

Start your free Prime trial →Free trial for eligible customers · Cancel anytime

As an affiliate, we earn on qualifying purchases.Hide

Security startup NebuSec disclosed a flaw in Telegram’s Android call code on October 29, saying an attacker could combine it with two other bugs to take control of a phone after its owner answered a call. Telegram Android version 12.10.4, released in September, contains a fix to the call-code issue, but the complete attack chain has not been independently documented in a public technical report.

NebuSec says the vulnerability affected Telegram for Android versions 8.6.2 through 12.10.3, a range spanning March 2022 to September 2026. The company describes the attack as requiring a person to answer an incoming call, making it a one-click attack, not a zero-click one. It says an ordinary Telegram account was sufficient for the attacker and that it confirmed the chain during private voice calls on ARM64 phones, a chip architecture used in most modern Android devices.

According to NebuSec chief executive Eten Zou, as quoted by The Hacker News, the call-code bug alone did not provide full access. He said it could be combined with a second flaw that leaks information and a third Android root exploit, which would grant administrator-level control of the device. NebuSec’s account says that could expose messages and provide access to the microphone and camera. Those additional flaws and the full chain remain the company’s claims; no detailed public technical write-up was available in the source material as of October 29.

A short demo video posted by NebuSec shows a call connecting on a phone labelled as the victim’s, followed by the device returning to its home screen and displaying a “HACKED BY NEBUSEC” graphic. The clip does not identify the Telegram or Android versions used. NebuSec said it reported the issue to Telegram on September 26. Zou said Telegram acknowledged the report but did not consider the bug exploitable as remote code execution; no CVE was assigned and no bug bounty was paid, according to his account. No public Telegram response was identified.

Why Call Permissions Matter

Voice calling requires an app to process data from another account as a call is being set up, including before a user has established that the caller is trustworthy. A flaw in that processing can make an ordinary action—answering a call—part of an attack path. If NebuSec’s described chain is accurate, the risk would extend beyond Telegram data to device-level access, because the claimed final step is an Android root exploit.

The reported scope and the evidence need to be kept distinct. NebuSec says it has seen no real-world attacks, but that is not independent confirmation that the flaw was never used. The report also says there is no CVE number, which can make the issue harder for organizations to identify if their security processes rely on vulnerability databases. For individual users, installing the fixed app version and limiting who can call are practical precautions while the technical details remain incomplete.

Products Worth Considering

Samsung Galaxy Tab S10 FE 128GB Wi-Fi Android Tablet, Blue

AmazonView Latest Price

Logitech MX Brio Ultra HD 4K Webcam, Graphite

AmazonView Latest Price

DJI Mic 3 Wireless Microphone System (2 Transmitters, 1 Receiver, Charging Case)

AmazonView Latest Price

As an affiliate, we earn on qualifying purchases.

The Fix Predates Disclosure

Telegram’s Android application source code is publicly available. The source material says a comparison between versions 12.10.3 and 12.10.4 showed a correction in the call code. In the earlier version, the code checked that a camera-rotation value was present but then read a separate video-state field that a message did not have to include. The later version reads the rotation field instead. This code comparison supports the existence of a change in that area, but it does not by itself establish the complete exploit chain NebuSec describes.

The account also says Telegram’s shared call library, tgcalls, received the same correction on April 21, 2026, under a change titled “Fix camera rotation.” The Android source containing the fix appeared later, on September 24, according to the source material. The Hacker News reported that iOS incorporated the change in May and desktop in July; whether the older code was exploitable on those platforms has not been shown. NebuSec said it had no evidence that iOS, desktop or group calls were directly affected.

As of October 29, the source material reported no CVE listing in the U.S. National Vulnerability Database and no Telegram entry in CISA’s known exploited vulnerabilities catalog. Those absences describe the public records checked at that time; they do not establish that the flaw was harmless or never exploited.

“Now picking up a wrong call can get you hacked.”

— NebuSec, in a post on X

What the Public Evidence Shows

The complete attack chain has not been laid out in a public technical report in the source material, and the demo does not show the software versions running on the devices. The two additional bugs, the claimed root exploit, and whether the chain works on a current, fully patched Android phone could not be independently checked. The source also does not establish whether anyone used the flaw before NebuSec disclosed it.

NebuSec said it had seen no attacks, but that statement is not proof that none occurred. The vulnerability has no CVE number, and the source material identifies no public Telegram comment. The direct exposure of other Telegram platforms or group calls remains unconfirmed; absence of evidence of exposure should not be read as evidence that every version is safe.

Update and Restrict Incoming Calls

Android users should update Telegram and check the version shown at the bottom of the app’s Settings page. The source material identifies 12.10.4 or later as the fixed Android version. Until updated, users can change “Who can call me?” to My Contacts or Nobody and decline calls from unfamiliar accounts. These measures reduce exposure to the reported call path but do not replace installing the update.

Organizations should check that work phones meet a minimum Telegram version and review messenger policies, particularly if their vulnerability monitoring depends only on CVE records. Further clarity would require a public technical analysis, details about the two other reported bugs, and a response from Telegram on the fix and platform scope. Until then, the reported patch is a concrete step users can take, while claims about full device compromise remain attributed to NebuSec.

Key Questions

Which Telegram Android versions did NebuSec identify?

NebuSec said the affected range was 8.6.2 through 12.10.3. It identified version 12.10.4 as containing the fix to the reported call-code issue.

Did an attacker need the user to answer the call?

Yes. NebuSec described the reported attack as requiring the user to answer, so it is a one-click attack rather than a zero-click attack.

Is there evidence that the flaw was used in real attacks?

NebuSec said it had seen no real-world attacks. The public information described here does not independently establish whether the flaw was ever used.

Were Telegram on iOS or desktop confirmed affected?

No. NebuSec said it had no evidence those apps or group calls were directly affected. The shared call library received a correction, but exploitability on other platforms has not been shown.

What should Telegram Android users do?

Update to version 12.10.4 or later. Until then, restrict incoming calls to contacts or nobody and avoid answering calls from unfamiliar accounts.

Source: ThorstenMeyerAI.com