TL;DR
Get privacy and security gear delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
Security startup NebuSec disclosed a Telegram for Android call-handling flaw on October 29, saying it could be chained with two other bugs to take control of a phone after a user answered a call. Telegram fixed the reported flaw in version 12.10.4 in September; NebuSec says it has seen no attacks, and the full attack chain has not been independently documented.
Security startup NebuSec disclosed a flaw in Telegram’s Android call code on October 29, saying an attacker could exploit it after a target answered a call if it was combined with two other bugs. Telegram had fixed the call-code flaw in version 12.10.4, released in September, but the complete attack chain has not been independently documented in public.
NebuSec chief executive Eten Zou told The Hacker News that the call flaw was one part of a three-bug chain. According to Zou, a second bug leaked information and helped an attacker escape Telegram’s app, while a third Android root exploit could provide administrator-level access. NebuSec said the attacker needed an ordinary Telegram account and the target had to answer the call. That would make the reported method a one-click attack, rather than an attack requiring no user action.
NebuSec said it confirmed the chain in private voice calls on ARM64 Android phones. Its October 29 post on X included a short demonstration video. The supplied account says the video shows a call connecting and the victim phone returning to its home screen, but it does not identify the Telegram or Android versions used. NebuSec’s research page had no detailed technical write-up of the flaw as of October 29, leaving the full chain dependent on the company’s account and demonstration.
The reported affected range is Telegram for Android 8.6.2 through 12.10.3, according to NebuSec. Version 12.10.4 contains the fix. A review of Telegram’s public Android source code cited in the source material found that version 12.10.3 checked whether a camera-rotation value was present but then read a separate video-state field that might be absent. Version 12.10.4 reads the rotation field instead. The source material says no CVE has been assigned and NebuSec reported seeing no real-world attacks.
Android security · Reported October 29, 2026
Why A Telegram Call May Be Part Of An Android Attack
NebuSec says a flaw in Telegram’s Android call handling could join two other bugs in a chain leading to phone takeover after a user answers. Telegram fixed the reported call flaw in version 12.10.4; the complete chain has not been independently documented in public.
A call was the starting point
The reported method depends on multiple flaws. The call bug alone is not described as sufficient for full device control.
Answer a voice call
NebuSec says the target had to answer a private Telegram call. That makes the reported scenario a one-click attack, rather than a zero-click one.
Additional bugs claimed
A second bug reportedly leaked information and helped an attacker escape Telegram. A third Android root exploit was said to provide administrator-level access.
Evidence has boundaries
NebuSec says it tested on ARM64 Android phones. The public demo does not identify software versions, and the full chain lacks a public technical write-up.
Call answered
User interaction begins the reported sequence.
App flaw
Call-handling issue is combined with a reported information leak.
Root access claimed
A separate Android exploit is said to enable device control.
This sequence summarizes NebuSec’s account. The complete chain has not been independently verified in a public technical report.
A narrow code change, a wider claim
The supplied report describes a mismatch in a video-call field and says the corrected code appeared in Telegram for Android 12.10.4.
Described in the report
- Version 12.10.3 checked whether a camera-rotation value existed, then read a separate video-state field that might be absent.
- Version 12.10.4 reads the rotation field instead, according to the cited source-code review.
- NebuSec said it reported the flaw on September 26, after version 12.10.4 had appeared.
Still unverified publicly
- The two additional bugs and the complete path to phone takeover.
- Which Telegram and Android versions were used in the demo, and how broadly the chain applies.
- Whether any attacker used the chain. NebuSec reported no real-world attacks.
Update Telegram for Android
NebuSec identified versions 8.6.2 through 12.10.3 as affected by the reported call flaw.
| Telegram for Android | Reported status | What to do |
|---|---|---|
| 8.6.2 through 12.10.3 | Reported affected | Update as soon as possible |
| 12.10.4 and later | Call flaw fixed | Check installed version in Settings |
Reduce exposure while details develop
Simple app-version checks address the reported fix, while call settings can limit contact from unknown callers.
For users and organizations
Check the app. Limit calls.
The next useful evidence would be a detailed technical account from NebuSec or a public response from Telegram explaining the reported chain and its conditions.
As of October 29, the supplied material reported no CVE, no entry in the U.S. known exploited vulnerabilities catalog, and no public Telegram statement. Those record gaps do not prove whether exploitation was possible or whether an attack occurred. NebuSec said it had no evidence of direct impact to iOS, desktop, or group calls.
The Risk of Answering a Call
The reported chain matters because a voice call can look like an ordinary interaction. If NebuSec’s account is accurate, answering a call could trigger a flaw in the app’s call handling, with additional bugs needed to move from that flaw to control of the Android device. The distinction matters: the report describes a user-action attack and does not establish that merely receiving a call is enough.
For individual users, the clearest practical step is to update Telegram for Android to version 12.10.4 or later and check the installed version in Settings. The source material also recommends restricting who can call you to contacts or nobody, and declining calls from unknown people until updated. For organizations, the absence of a CVE means processes that rely only on vulnerability identifiers may not flag the issue; app-version requirements for managed phones can help address that gap.
Products Worth Considering
Bose QuietComfort Wireless Bluetooth Headphones with Active Noise Cancellation, Mic, USB‑C Charging, Deep Bass, 24‑Hour Battery – White Smok
Samsung Galaxy Tab S10 FE 128GB Wi-Fi Android Tablet, Blue
DJI Mic 3 Wireless Microphone System (2 Transmitters, 1 Receiver, Charging Case)
As an affiliate, we earn on qualifying purchases.
A Fix Before Public Disclosure
NebuSec said it reported the flaw to Telegram on September 26, shortly after version 12.10.4 had appeared. Zou told The Hacker News that Telegram acknowledged the report but did not believe the issue could be used for remote code execution. According to Zou, no CVE was assigned and no bounty was paid. The source material reports no public response from Telegram as of October 29.
The source-code review described in the supplied report also found that Telegram’s shared call library received a correction on April 21, 2026, in a change titled “Fix camera rotation.” The Android source with the correction appeared later, in September. The report says the shared library is used by Telegram’s Android, iOS and desktop apps, but it does not establish that the vulnerable Android behavior could be exploited on those other platforms. NebuSec said it had no evidence that iOS, desktop or group calls were directly affected.
As of October 29, the source material found no entry for the flaw in the U.S. National Vulnerability Database and no Telegram entry in the Cybersecurity and Infrastructure Security Agency’s known exploited vulnerabilities catalog, cited as current through October 28. Those absences do not establish whether the flaw was exploitable or whether an attack occurred; they describe the status of those public records at that time.
““Now picking up a wrong call can get you hacked.””
— NebuSec, in a post on X
What the Public Evidence Shows
The full exploit chain remains unverified in a public technical write-up. The supplied material describes NebuSec’s video and Zou’s account, but says the video does not reveal the victim phone’s software versions and that the two additional bugs could not be checked independently. Telegram’s response to the report is also known only through Zou’s account; no public company statement was identified in the source material.
It is not clear whether the chain works on current Android versions, how broadly it applies across devices, or whether any attackers used it. NebuSec said it had seen no real attacks. The supplied report also does not establish direct exposure for Telegram on iOS or desktop, or for group calls. No CVE or known-exploitation listing was reported as of October 29.
Update and Watch for Details
Android users should check that Telegram is running version 12.10.4 or later. People unable to update immediately can limit incoming calls to contacts or nobody, as suggested in the source material. Organizations may want to verify app versions on managed devices rather than rely solely on CVE alerts.
The next useful evidence would be a detailed technical account from NebuSec or a public response from Telegram explaining the reported chain and affected conditions. Until then, the fixed call-code flaw is supported by the source-code comparison described in the report, while claims about full device takeover remain attributed to NebuSec.
Key Questions
What did NebuSec report?
NebuSec reported a flaw in Telegram’s Android call code and said it could be combined with two other bugs to take control of a phone after the user answered a call. The full chain has not been independently documented in a public technical report.
Which Telegram Android versions are reported as affected?
NebuSec identified versions 8.6.2 through 12.10.3 as affected. The source material says Telegram fixed the call-code flaw in version 12.10.4.
Does the attack work without answering a call?
The reported method requires the target to answer. NebuSec described it as a one-click attack, not a zero-click attack.
Have attacks been confirmed?
NebuSec said it had seen no real-world attacks. The supplied material reports no CVE or entry in the U.S. known exploited vulnerabilities catalog as of October 29, 2026.
What should Android users do?
Update Telegram to version 12.10.4 or later and check the version in Settings. Until updated, the source material recommends limiting who can call you and declining calls from unknown people.
Source: Thorsten Meyer AI
