TL;DR
Get privacy and security gear delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
Security startup NebuSec says a flaw in Telegram for Android’s call code could be chained with two other bugs to take control of a phone after the recipient answered a call. Telegram’s Android version 12.10.4, released in September 2026, contains a correction, but the full attack chain has not been independently documented publicly and NebuSec says it has seen no real-world attacks.
Security startup NebuSec disclosed a flaw in Telegram for Android that it says could help an attacker take control of a phone after the user answered a call, if the flaw were combined with two other bugs. Telegram Android version 12.10.4, released in September 2026, contains a correction to the call code, according to the source material; the full attack chain has not been independently documented in a public technical report.
NebuSec said the affected range was Telegram for Android versions 8.6.2 through 12.10.3, spanning March 2022 to September 2026. The company said the call-code bug alone was not sufficient to take over a phone: it had to be combined with an information-leak bug and a separate Android root exploit. A root exploit can grant administrator-level access to a device. NebuSec said the resulting chain could expose messages and give access to the microphone and camera.
NebuSec chief executive Eten Zou told The Hacker News that the company tested the chain in private voice calls on ARM64 phones, a processor architecture used by most modern Android phones. The source material describes a short demonstration video, but says it does not identify the Telegram or Android versions on the device shown. It also says NebuSec had not published a technical write-up describing the full chain as of October 29.
The source author compared Telegram’s publicly available Android code for versions 12.10.3 and 12.10.4. In the earlier version, the call code checked for a video-rotation value but then read a different field that might not be present in the message. The later version reads the rotation field. NebuSec reported the flaw to Telegram on September 26, after the fixed Android version had appeared. Zou said Telegram acknowledged the report but disputed that the bug could be used for remote code execution. The source reports no assigned CVE and no bounty payment.
Why Call Handling Matters
The report highlights how a familiar action—answering an incoming call—could become part of an attack when software mishandles data exchanged during the call. NebuSec’s account describes a one-click scenario, meaning the user must answer; it does not describe a zero-click attack that works without user interaction. That distinction matters when judging both the risk and the precautions users should take.
For people still using an affected release, the straightforward step is to update Telegram for Android to version 12.10.4 or later and check the installed version in the app’s settings. Until then, the source recommends restricting who can call the account to contacts or nobody and declining calls from strangers. Those settings can reduce exposure to unsolicited calls, but the source does not present them as a substitute for installing the update.
The disclosure also creates a challenge for workplace security teams. The source notes that tools relying only on CVE identifiers may not flag a flaw with no CVE. Organizations can set minimum app versions for work phones and establish rules for messaging apps, while recognizing that the public evidence about this particular attack chain remains limited.
Products Worth Considering
Jackery HomePower 3000 Portable Power Station with Two 200W Solar Panels
DJI Osmo Pocket 3 Creator Combo Vlogging Camera with Mic 2, 1 CMOS, 4K/120fps, 3-Axis Stabilization, 128GB Card
Samsung Galaxy Tab S10 FE 128GB Wi-Fi Android Tablet, Blue
As an affiliate, we earn on qualifying purchases.
How the Fix Reached Android
The source author says Telegram’s shared call library, tgcalls, received the same code correction on April 21, 2026, in a change described as “Fix camera rotation.” The Android source containing the correction appeared later: version 12.10.4 was published on September 24, while the preceding version 12.10.3 appeared on September 17. The author characterizes the earlier change as having been treated as a camera issue rather than a security flaw; that is the author’s interpretation, not a confirmed statement from Telegram.
According to the source material’s account of The Hacker News reporting, the iOS app incorporated the shared-library change in May and the desktop app in July. That does not establish those apps were exploitable: the source says NebuSec had no evidence that iOS, desktop, or group calls were directly affected. The source also reports that the U.S. National Vulnerability Database had no CVE entry for the flaw on October 29 and that the version of CISA’s known-exploited-vulnerabilities catalog dated October 28 had no Telegram entry. Those absences do not, by themselves, prove that a vulnerability is harmless or that exploitation did not occur.
“Now picking up a wrong call can get you hacked.”
— NebuSec, in its October 29 post on X
Limits of the Public Evidence
The complete exploit chain remains unverified in public material described by the source. NebuSec’s claims rely on its demonstration and Zou’s account to The Hacker News; the source says no detailed technical write-up was available on October 29. It also says the demonstration does not show the software versions involved, and that the author could not independently check the two additional bugs or confirm the chain across current Android devices.
NebuSec said it had seen no real-world attacks. The source reports no CVE assignment and no public Telegram statement responding to the disclosure. It is not clear from the material why Telegram rejected the remote-code-execution assessment, whether Telegram will publish its own explanation, or whether any version outside the stated Android range is vulnerable. The absence of a CVE or a listing in an exploited-vulnerability catalog is not proof that exploitation never happened.
Update Devices and Await Details
Android users should check Telegram’s version and install 12.10.4 or a later release if available. Users who cannot update immediately can limit incoming calls through Telegram’s privacy settings, as the source recommends. Employers can check app versions on managed phones and account for software fixes that may not appear in CVE-based tracking.
The next useful developments would be a technical account from NebuSec that explains the full chain, a public response from Telegram, or independent analysis that tests the claims and clarifies which devices and app versions are affected. Until then, the confirmed scope should remain narrow: the source describes a correction to Telegram’s Android call code, while the claimed full device takeover depends on additional bugs whose details have not been publicly established in the material provided.
Key Questions
Which Telegram Android versions did NebuSec identify as affected?
NebuSec identified versions 8.6.2 through 12.10.3 as affected. Telegram Android version 12.10.4 contains the call-code correction, according to the source material.
Did answering a call by itself give an attacker full control?
NebuSec said the call-code flaw needed to be combined with two other bugs to produce a full phone takeover. The source does not provide a public technical report that independently verifies that chain.
What should Telegram Android users do?
Update Telegram to version 12.10.4 or later and verify the installed version in Settings. If an update is not immediately possible, the source recommends limiting who can call the account and declining calls from strangers.
Were Telegram for iOS or desktop confirmed to be vulnerable?
No. The source says NebuSec had no evidence that iOS or desktop apps, or group calls, were directly affected. It reports that related code changes reached those platforms, but that does not establish whether the older code could be exploited there.
Has NebuSec reported attacks in the wild?
NebuSec said it had seen no real-world attacks. The source also says there was no CVE for the flaw as of October 29, 2026; neither fact establishes that exploitation was impossible.
Source: Thorsten Meyer AI
