Security startup NebuSec disclosed a flaw in Telegram for Android on October 29, saying it could help attackers take control of a phone after a user answered a call. Telegram had fixed the call-code issue in version 12.10.4, released in September, but the full attack chain rests on NebuSec’s account and has not been documented in a public technical report.

NebuSec says the affected Android app versions were 8.6.2 through 12.10.3, spanning March 2022 to September 2026. The company says the call flaw alone was insufficient: combined with two other bugs, it could let an attacker escape Telegram’s protections and gain control of the phone. NebuSec chief executive Eten Zou told The Hacker News that an attacker needed only a Telegram account, and that the company confirmed the chain in private voice calls on ARM64 phones.

NebuSec posted a short demonstration on X showing a call connect before the victim phone returned to its home screen. The clip does not identify the Telegram or Android versions shown. NebuSec’s research page had no full technical report as of October 29, leaving the details of the alleged exploit chain unverified publicly. The company said it had seen no real-world attacks.

A comparison of Telegram’s public Android source code for versions 12.10.3 and 12.10.4 shows a change in how call status messages handle a video rotation field. In the older code, the app checked that one value was present but read a different field; the updated code reads the checked field. That source-code change supports the existence of a bug in the call code, but does not by itself verify NebuSec’s claims about the other bugs or a complete phone takeover.

Why Answered Calls Matter

The reported attack required a person to answer an incoming call, making it a one-click scenario rather than an attack that succeeds without user action. If NebuSec’s description of the full chain is accurate, answering could have exposed private messages and enabled access to the microphone or camera. Those consequences remain claims, not independently confirmed findings.

For individuals, the available fix is straightforward: install Telegram 12.10.4 or later and check the version shown at the bottom of Settings. Until updated, users can set “Who can call me?” to My Contacts or Nobody and avoid answering unexpected calls. For organizations, the absence of a CVE may mean tools that track only numbered vulnerabilities will not flag the issue; administrators may need to enforce minimum app versions directly.

Popular right now

Roborock Qrevo CurvX Robot Vacuum and Mop

AmazonView Latest Price

Ninja CREAMi 7-in-1 Ice Cream Maker, NC301

AmazonView Latest Price

Bose QuietComfort True Wireless Earbuds with Active Noise Cancellation, Black

AmazonView Latest Price

As an affiliate, we earn on qualifying purchases.

The Fix Predates Disclosure

NebuSec said it reported the issue to Telegram on September 26, shortly after version 12.10.4 appeared. Zou told The Hacker News that Telegram acknowledged the report but did not believe the bug could be used for remote code execution. According to Zou, no CVE was assigned and no bounty was paid. The Hacker News sought comment from Telegram; the source material reports no public reply.

Telegram’s shared call library, tgcalls, received a similar correction on April 21, 2026, in a change titled “Fix camera rotation.” The Android source containing the fix appeared later, according to the source material. The Hacker News reported that the iOS app included the change in May and the desktop app in July. The available evidence does not establish whether the older code in those apps could be exploited.

As of October 29, the US National Vulnerability Database had no CVE entry for the flaw, and the CISA catalog of known exploited vulnerabilities had no Telegram entry. Those absences do not establish that the issue is harmless; they show that it was not listed in those records at that time.

“Now picking up a wrong call can get you hacked.”

— NebuSec post on X

What the Public Evidence Shows

The reported chain’s two additional bugs, its claimed route to full device control and the exact devices and software versions involved have not been laid out in a public technical report. The demonstration does not show the victim’s app or Android version, and the source material says the additional bugs could not be checked independently. NebuSec reported no attacks seen, while the absence of a CVE or CISA listing is not evidence that none occurred. It also remains unclear whether older iOS or desktop code, or group calls, are affected.

Update and Watch for Details

Android users should update Telegram to version 12.10.4 or later and confirm the installed version in Settings. Anyone who cannot update immediately can limit incoming calls to contacts or disable them, then decline unexpected calls.

Further confirmation would depend on a public technical write-up, a response from Telegram, or additional vulnerability records. Until then, the call-code correction is visible in Telegram’s source, while the broader claim of a chained takeover remains attributed to NebuSec.

Key Questions

Which Telegram Android versions does NebuSec say were affected?

NebuSec identifies versions 8.6.2 through 12.10.3 as affected. It says Telegram fixed the reported call-code issue in version 12.10.4.

Did answering a call alone give an attacker control of a phone?

NebuSec says the call flaw had to be combined with two other bugs to enable a takeover. The complete chain has not been independently verified in a public technical report.

What should Telegram users do now?

Install Telegram 12.10.4 or later and check the version in Settings. Until updated, restrict calls to contacts or turn off incoming calls and avoid answering unexpected calls.

Are Telegram on iPhone and desktop affected?

The available reporting does not establish that those apps are vulnerable. The shared call library received a similar correction, but exploitability in older iOS or desktop versions has not been shown.

Has Telegram confirmed the attack or reported active exploitation?

The source material reports no public Telegram statement and says NebuSec had seen no real-world attacks. NebuSec’s account of the exploit chain remains a claim pending fuller public technical detail.

Source: Thorsten Meyer AI