Telegram Call Security On Android: What Users Need To Know

Read the full analysis: Telegram Call Security On Android: What Users Need To Know on ThorstenMeyerAI.com

Security startup NebuSec disclosed a flaw in Telegram’s Android call code on October 29, saying an attacker could exploit it after a user answered a call and combine it with two other bugs to gain control of the phone. The reported code issue was fixed in Telegram Android 12.10.4, released in September, but the full exploit chain has not been documented publicly and NebuSec says it has seen no real-world attacks.

NebuSec says the flaw affected Telegram for Android versions 8.6.2 through 12.10.3, covering releases from March 2022 to September 2026. The company describes the attack as requiring the victim to answer a call, making it a one-click scenario rather than an attack that works without user action. It says the call-code flaw alone was not sufficient: an attacker also needed a second bug to escape the app and an Android root exploit to obtain administrator-level control.

NebuSec chief executive Eten Zou described the chain to The Hacker News. According to Zou, the attacker needed a regular Telegram account, and the company tested the chain in private voice calls on ARM64 phones. NebuSec has not published a technical report detailing the additional bugs. Its short demonstration video shows a call connecting before the victim phone returns to its home screen, but does not identify the Telegram or Android versions used.

A review of Telegram’s publicly available Android source code found a difference between versions 12.10.3 and 12.10.4 in how call status messages are handled. In the earlier code, the app checked that one field was present but then read a different field that the message did not have to include; the later version reads the expected field. This supports the existence of a code correction, but does not independently verify that the complete attack chain works as NebuSec described. Telegram acknowledged the report, Zou told The Hacker News, but reportedly disputed that the issue could lead to remote code execution. No public Telegram statement was found by October 29.

Why Call Handling Matters

Voice calls can expose apps to information from people who are not in a user’s contacts, so the call setup process is a security boundary, not just a convenience feature. In this case, the reported flaw involved how Telegram’s Android app processed call-related status data. If NebuSec’s account of the chain is accurate, answering an unexpected call could have helped trigger a sequence leading beyond the app to broader device access.

For users, the practical step is straightforward: update Telegram for Android and check that the version shown in Settings is 12.10.4 or later. Until updated, the source advises restricting “Who can call me?” to My Contacts or Nobody and declining calls from unknown people. These settings can reduce exposure to unsolicited calls, but the source does not establish that they eliminate every possible route to exploitation.

The report also matters to organizations that track mobile risk through vulnerability databases. The flaw has no CVE identifier, and it does not appear in the US catalog of known exploited vulnerabilities cited by the source. Companies relying only on CVE alerts may not flag the issue, so they may need to set and enforce minimum app versions on managed phones.

How the Fix Reached Android

Telegram’s shared call library, tgcalls, is used across Android, iOS and desktop applications. The source says the shared code received the correction on April 21, 2026, in a change titled “Fix camera rotation.” The Android source containing the change appeared later, in versions 12.10.4, released in September. The source describes the Android fix as appearing 156 days after the shared-library change.

The report says iOS included the code change in May and desktop in July, citing The Hacker News. That does not establish that those versions were exploitable: NebuSec reported testing the chain on Android, and the available material does not show direct impact on iOS, desktop or group calls. The correction’s presence across codebases is not, by itself, proof that the same vulnerability could be exploited on every platform.

As of October 29, the US National Vulnerability Database had no CVE entry for the flaw, and the CISA known-exploited-vulnerabilities catalog cited by the source had no Telegram listing. NebuSec said it reported the issue on September 26, after version 12.10.4 had appeared. The source reports that Telegram acknowledged the report but did not accept the claim that it enabled remote code execution; no bounty was paid, according to Zou.

“Now picking up a wrong call can get you hacked.”

— NebuSec’s October 29 post on X

What the Evidence Does Not Show

The main unresolved issue is the full exploit chain. NebuSec has not released a technical write-up of the additional information-leak and Android root bugs, and the demonstration video does not show the versions or technical steps needed to assess the claim. The source’s review of Telegram’s public code supports the existence of a call-code correction, but cannot confirm the claimed path from that flaw to full device control.

It is also unclear whether the chain works on a fully patched Android phone, whether any attacker used it before disclosure, or whether the related code was exploitable in iOS or desktop apps. NebuSec said it had seen no real attacks; that is not proof that none occurred. No CVE has been assigned, and the source found no public response from Telegram as of October 29.

Update and Watch for Documentation

Android users should install the latest Telegram version available to them and verify that it is at least 12.10.4. Users who cannot update immediately can limit incoming calls to contacts or disable them, and avoid answering unexpected calls. Organizations should check app versions on managed devices rather than rely solely on CVE-based alerts.

The next useful development would be a technical account from NebuSec, a public response from Telegram, or independent analysis that tests the claimed exploit chain and clarifies affected Android versions. Until that evidence appears, the code fix is supported by the source comparison, while claims of full phone takeover remain attributed to NebuSec.

Key Questions

Which Telegram Android versions are reported as affected?

NebuSec says versions 8.6.2 through 12.10.3 were affected. The reported fix is in version 12.10.4.

What should Android users do?

Update Telegram to version 12.10.4 or later and check the version shown in the app’s Settings. Until updated, restrict who can call you and avoid answering unexpected calls.

Did answering a call alone give an attacker full control?

NebuSec says the call flaw had to be combined with two other bugs to reach full device control. The company has not published enough technical detail for the complete chain to be independently verified.

Have attacks been confirmed?

NebuSec says it has seen no real-world attacks. That statement does not establish that the flaw was never used.

Are iPhone and desktop users affected?

The source says the same shared-library correction appeared in iOS and desktop code, but NebuSec has not shown that those versions were exploitable. Direct impact outside Android remains unconfirmed.

Source: ThorstenMeyerAI.com