Could Answering The Call Be Part Of Telegram’s Android Attack?

🔍 Read the full analysis: Could Answering The Call Be Part Of Telegram’s Android Attack? on ThorstenMeyerAI.com

Before you orderOffer from Amazon

Get the latest gadgets delivered free with Prime

• Fast, free delivery on millions of items
• Prime Video, Amazon Music and more included
• Member-only deals all year

Start your free Prime trial →Free trial for eligible customers · Cancel anytime

As an affiliate, we earn on qualifying purchases.Hide

Security startup NebuSec disclosed a flaw in Telegram’s Android call code on October 29, saying it could be chained with two other vulnerabilities to give an attacker control of a phone after a user answered a call. The reported bug was fixed in Telegram Android 12.10.4, released in late September, but key details of the wider attack chain remain unverified in a public technical report.

NebuSec says the flaw affected Telegram for Android versions 8.6.2 through 12.10.3, a range spanning March 2022 to September 2026. According to the company’s chief executive, Eten Zou, the call-code bug alone was not enough to take over a device. It allegedly worked with a second bug that exposed information and a third vulnerability that provided Android root access, or administrator-level control. NebuSec says an attacker needed an ordinary Telegram account and that the attack worked in private voice calls on ARM64 phones.

The company’s October 29 social-media post included a short demonstration. It shows a call connecting on a victim phone before the display changes, but it does not identify the Telegram or Android versions running on that device. NebuSec has not published a detailed technical write-up of the flaw or the other parts of the alleged chain. Its claims about the full takeover therefore rely on the demo and statements from the company, rather than a public analysis that independent researchers can reproduce.

The underlying code change is visible in Telegram’s public Android source code. A comparison of versions 12.10.3 and 12.10.4 shows a change in how the app reads a call-status message about video rotation. In the earlier code, the app checked for one field and then read a different field that might not be present; the later code reads the field it checked. The same correction appeared in Telegram’s shared call library in April 2026, before the Android release. The available code supports the existence of a relevant fix, but does not by itself establish that the bug could be used to gain control of a phone.

Why Answering a Call Matters

The reported attack is described as one-click, not zero-click: a user would have to answer the incoming call. That distinction matters because the interaction is ordinary and may not look like a security decision. NebuSec’s account also makes clear that the call-code flaw was only one part of the alleged chain; the claimed device takeover depended on additional vulnerabilities.

For users, the immediate practical step is to update Telegram for Android to version 12.10.4 or later and avoid answering calls from unknown accounts until updated. Users can also limit who may call them through Telegram’s privacy settings. For employers, the case highlights a gap in vulnerability tracking: the source material reports no CVE identifier, so systems that rely only on CVE alerts may not flag the issue. Organizations can set minimum app versions for work phones and define rules for messaging apps without treating the unverified exploit details as established fact.

Call features can expose an app to data from people who are not already trusted contacts. That makes secure handling of call setup and status messages important. In this case, the public evidence supports a code correction, while the claim that answering a call could lead to full device control remains tied to NebuSec’s account.

Products Worth Considering

DJI Osmo Pocket 3 Vlogging Camera with 1-Inch CMOS Sensor and 4K Video

AmazonView Latest Price

DJI Mic 3 Wireless Microphone System (2 Transmitters, 1 Receiver, Charging Case)

AmazonView Latest Price

Samsung Galaxy Tab S10 FE 128GB Wi-Fi Android Tablet, Blue

AmazonView Latest Price

As an affiliate, we earn on qualifying purchases.

The Fix Predates the Disclosure

NebuSec says it reported the issue to Telegram on September 26, 2026, shortly after version 12.10.4 had appeared. Zou told The Hacker News that Telegram acknowledged the report but did not agree that the issue could be used for remote code execution. According to Zou, no vulnerability identifier was assigned and no bounty was paid. The source material reports no public response from Telegram.

The timeline in Telegram’s public code adds detail. The shared call library, used across Telegram’s Android, iOS and desktop apps, received a correction titled “Fix camera rotation” on April 21, 2026. The Android source containing the fix appeared later, in version 12.10.4. The Hacker News reported that iOS included the change in May and desktop in July, but the available material does not establish that those apps were exploitable. NebuSec has not shown that group calls or those other platforms were directly affected.

As of October 29, the source material reported no CVE for the flaw in the U.S. National Vulnerability Database and no Telegram listing in the Cybersecurity and Infrastructure Security Agency’s known-exploited-vulnerabilities catalog as of October 28. Those absences do not prove that no exploitation occurred; they describe the public records checked at those dates.

“Now picking up a wrong call can get you hacked.”

— NebuSec, in its October 29 post on X

What the Public Evidence Shows

The full exploit chain has not been publicly documented. NebuSec has not released technical details for the two additional bugs it says were needed, and the demonstration does not reveal the software versions on the victim device. The source material also says it could not verify whether the chain works against a current, fully patched Android phone or whether anyone used the flaw before disclosure.

NebuSec says it has seen no real-world attacks. That is a statement about the company’s observations, not proof that the vulnerability was never exploited. It is also not yet clear whether any Telegram versions outside the reported Android range were vulnerable, or whether the shared-library correction addressed an exploitable issue on iOS or desktop.

Update Devices and Watch for Details

Android users should check Telegram’s version in the app settings and install 12.10.4 or later if an update is available. Until updated, users can restrict incoming calls to contacts or nobody and decline unexpected calls. Businesses should check app-version compliance on managed phones and avoid relying solely on CVE feeds to identify messenger security updates.

The next useful development would be a technical account from NebuSec, Telegram, or independent researchers that explains the additional vulnerabilities, affected Android versions and conditions required for the chain. A public response from Telegram could also clarify how it classified the fix and whether other platforms were assessed. Until then, the Android code change is verifiable, while claims of complete phone takeover should remain attributed to NebuSec.

Key Questions

What did NebuSec report about Telegram?

NebuSec said a flaw in Telegram for Android’s call code could be combined with two other bugs to take control of a phone after a user answered a call. The company has not published a full technical report of that chain.

Which Telegram version contains the reported fix?

The reported fix is in Telegram for Android 12.10.4. Users should check the app’s settings and update to that version or a later release.

Was the issue zero-click?

No. NebuSec’s description requires the victim to answer an incoming call, making the reported attack one-click rather than zero-click.

Is there proof that attackers used the flaw?

NebuSec says it has seen no real-world attacks. The source material reports no public evidence confirming exploitation, but the absence of observed attacks does not establish that none occurred.

Were Telegram on iOS and desktop affected?

That has not been established. The shared call library was corrected and the source material reports later updates to iOS and desktop, but direct exploitability on those platforms has not been shown.

Source: ThorstenMeyerAI.com