🔍 Read the full analysis: Telegram Call Flaw On Android: A Roundup Of Known Details on ThorstenMeyerAI.com
Get hardware and tech essentials delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
TL;DR
NebuSec disclosed a Telegram for Android call-handling flaw on October 29, saying it could be chained with two other bugs to take control of a phone after a user answered. Telegram’s Android version 12.10.4 contains a related code fix, but the full exploit chain has not been independently documented publicly, and NebuSec says it has seen no attacks.
Security startup NebuSec disclosed a Telegram for Android call flaw on October 29, saying an attacker could take control of a phone after a user answered a call if the flaw were combined with two other bugs. Telegram’s Android version 12.10.4 contains a fix for the call-code issue, but the complete attack chain has not been documented publicly, and NebuSec says it has seen no real-world attacks.
NebuSec says the flaw affected Telegram for Android versions 8.6.2 through 12.10.3, spanning March 2022 to September 2026. The company described the bug as a memory-handling issue in voice-call code. It said an attacker first needed the target to answer an incoming call, making the proposed attack one-click rather than zero-click. The source material identifies version 12.10.4 as the release containing the fix.
According to NebuSec chief executive Eten Zou, the call flaw by itself was not enough to take over a phone. He said an attacker could combine it with a second bug to escape the Telegram app into Android, then use a third bug to gain root access, or full administrator control. NebuSec said it tested the chain in private voice calls on ARM64 phones, a chip architecture used by most modern Android phones. The company said the chain could expose messages and give access to the microphone and camera.
The source material reports that NebuSec disclosed the issue on X with a short demonstration video. The video shows a call connecting and the victim phone returning to its home screen, but it does not identify the Telegram or Android versions used. The source author also compared Telegram’s publicly available Android code for versions 12.10.3 and 12.10.4, finding that the later version reads the call message’s rotation field rather than a different field. That code comparison supports the existence of a change, but does not independently establish the full takeover chain.
Infographic 01 · Telegram for Android
One tap on “answer”, three bugs, one fix.
What is confirmed, what rests on NebuSec’s word, and what nobody knows yet about the voice-call flaw fixed in Telegram for Android 12.10.4.
- The callAn ordinary Telegram account calls the victim
- The tapThe victim answers. Without this, no attack
- Bug 1Call code misreads a status message (MediaState)
- Bug 2An information leak helps break out of the app
- Bug 3An Android root exploit: messages, mic, camera
Chain as described by NebuSec’s CEO to The Hacker News. Bugs 2 and 3 are not public; no technical write-up exists yet.
- The bug and the fix match in Telegram’s public source (12.10.3 vs 12.10.4)
- Same correction in the shared call library on 21 Apr 2026, titled “Fix camera rotation”
- No CVE in the US vulnerability database (29 Oct)
- No Telegram entry in CISA’s exploited-bugs catalog (28 Oct)
- Three chained bugs give full control of the phone
- Versions 8.6.2 to 12.10.3 are affected
- Its GPT-5.4-based product found the bug
- No real attacks seen; Telegram did not see code execution, paid no bounty
- What bugs 2 and 3 are
- Whether the chain works on fully patched Android
- Whether the old iOS and desktop code was exploitable
- Telegram’s own statement
- Mar 2022Version 8.6.2First version NebuSec names as affected
- 21 Apr 2026Shared call library fixedtgcalls change “Fix camera rotation”. iOS picks it up in May, desktop in July (per The Hacker News)
- 24 Sep 2026Android 12.10.4 source published156 days after the library fix (my arithmetic)
- 26 Sep 2026NebuSec reports to TelegramTelegram acknowledges, does not consider it code execution (per NebuSec)
- 29 Oct 2026Public disclosurePost on X with a 22-second demo video
Sources: NebuSec on X, 29 Oct 2026; The Hacker News, 29 Oct 2026; Telegram Android source 12.10.3 vs 12.10.4; tgcalls, 21 Apr 2026; NVD search, 29 Oct 2026; CISA KEV 2026.10.28. Status labels and arithmetic: Thorsten Meyer.
Powered by Thorsten Meyer AI
Why Answering a Call Matters
The reported issue matters because answering a call is an ordinary user action, while call software must process messages from the person calling. If NebuSec’s account of the exploit chain is accurate, that combination could make an incoming call a route from a messenger app into the wider phone system. The company’s description of possible access to messages, the microphone and the camera points to a broader privacy risk than a call disruption alone.
For users, the confirmed practical step is to update Telegram for Android to version 12.10.4 or later. Until updated, the source recommends limiting who can call through Telegram’s privacy settings and declining calls from unknown people. For organizations, the reported lack of a CVE matters because security tools and workflows that rely on CVE records may not flag the issue. The source material recommends setting minimum app-version requirements for work phones.
Those precautions should not be mistaken for proof that the full exploit is in active use. NebuSec says it has seen no real attacks, and the public material described here does not provide a technical report that allows outside researchers to reproduce the chain.
Products Worth Considering
Trezor Safe 7 Crypto Hardware Wallet
Logitech MX Mechanical Full-Size Wireless Mechanical Keyboard, Tactile Quiet Switches, Backlit Keys, Bluetooth, USB-C, Multi-Device, Graphit
Apple MacBook Pro 16.2-inch with M5 Pro, 18-core CPU, 20-core GPU, 48GB Memory, 1TB SSD, Wi-Fi 7, Space Black
As an affiliate, we earn on qualifying purchases.
How the Android Fix Emerged
NebuSec said it reported the flaw to Telegram on September 26, after version 12.10.4 had appeared. Zou told The Hacker News that Telegram acknowledged the report but did not believe the issue could be used for remote code execution. According to Zou, no CVE was assigned and no bounty was paid. The source material says it found no public response from Telegram to The Hacker News’ request for comment.
The source author’s code review found that Telegram’s shared call library, tgcalls, received a similar correction on April 21, 2026, in a change titled “Fix camera rotation.” The Android source containing the fix appeared later, on September 24, the author reported. The Hacker News reported that iOS incorporated the change in May and desktop in July. These code changes do not, by themselves, establish that those other platforms were exploitable; the source says NebuSec had not shown that.
As of October 29, the source reports no CVE entry for the flaw in the U.S. National Vulnerability Database and no Telegram listing in the cited CISA catalog of known exploited vulnerabilities. The absence of those listings is a record of what those databases contained at that time, not evidence that the bug could not be exploited.
“Now picking up a wrong call can get you hacked.”
— NebuSec, in a post on X
What the Public Evidence Shows
The full exploit chain remains unverified in public technical detail. NebuSec’s demonstration video does not show the software versions involved, and the company had not published a technical write-up as of October 29, according to the source material. The reported second and third bugs, including the Android root exploit, could not be checked by the source author.
It is also unclear whether the chain works on a current, fully patched Android phone, whether anyone exploited the flaw before disclosure, or whether any versions of Telegram for iOS or desktop were vulnerable. NebuSec said it had no evidence of attacks and had not shown those other platforms to be affected. No CVE or CISA exploited-vulnerability listing was present at the stated time, but the lack of a listing does not prove there was no prior exploitation.
Updates and Further Verification
Telegram users should check the app version in Settings and update to 12.10.4 or later if they are using Android. The source also advises users who have not updated to restrict incoming calls to contacts or nobody and to avoid answering calls from unknown people. These are precautions; they do not confirm that a particular caller is attempting an exploit.
The next useful developments would be a public technical account from NebuSec, a response from Telegram, and independent analysis of the call flaw and the two additional bugs. Researchers and organizations may also watch for any later vulnerability database entries or platform advisories. Until more evidence is published, the exact reach of the reported chain and whether it was used outside testing remain open questions.
Key Questions
Which Telegram Android versions does NebuSec say were affected?
NebuSec identified versions 8.6.2 through 12.10.3 as affected. The source material says version 12.10.4 contains the call-code fix.
Did answering a call alone give an attacker control of a phone?
Not according to NebuSec’s account. Chief executive Eten Zou said the call flaw had to be combined with two additional bugs to achieve the reported device takeover. The complete chain has not been documented publicly in the source material.
Has NebuSec reported real-world attacks?
No. NebuSec said it had seen no real attacks. That statement does not establish whether the flaw was never used; the source says prior exploitation could not be checked.
Are Telegram on iPhone and desktop confirmed affected?
No. The source material says NebuSec had not shown that iOS or desktop versions were directly affected. Related shared-code changes were reported on those platforms, but their exploitability has not been established.
What should Android users do now?
Update Telegram to version 12.10.4 or later. If unable to update immediately, the source recommends limiting who can call through Telegram’s privacy settings and declining calls from unknown people.
Source: ThorstenMeyerAI.com
