TL;DR
Get privacy and security gear delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
Security startup NebuSec says a flaw in Telegram for Android’s call code could be combined with two other bugs to take control of a phone after its owner answered a call. Telegram Android 12.10.4, released in September 2026, contains a correction, but the full attack chain has not been independently documented publicly, and NebuSec says it has seen no real attacks.
Security startup NebuSec disclosed a flaw in Telegram’s Android calling code on October 29, saying that an attacker could use it as part of a chain of bugs to take control of a phone after its owner answered a call. The reported issue was fixed in Telegram Android 12.10.4, released in September, but the complete attack chain has not been detailed in a public technical report.
NebuSec chief executive Eten Zou told The Hacker News that the call-code flaw was one part of a three-bug chain. According to Zou, a second bug exposed information that helped an attacker move beyond the Telegram app, while a third Android exploit provided root access, or administrator-level control. The company said an attacker needed an ordinary Telegram account and that the chain worked in private voice calls on ARM64 phones. Those details are NebuSec’s account; its public post and short demonstration do not independently establish each stage.
NebuSec said it reported the issue to Telegram on September 26, after version 12.10.4 had appeared. Zou said Telegram acknowledged the report but did not consider the flaw capable of remote code execution, and that no CVE identifier or bounty followed. The Hacker News sought comment from Telegram. The source material reports no public response from the company as of October 29.
A comparison of Telegram’s publicly available Android source code for versions 12.10.3 and 12.10.4 found a change in how call status messages handle a video rotation value. In the earlier version, the code checked whether one field was present and then read a different field that could be absent; the later version reads the checked field. That code change supports the presence of a correction, but by itself does not verify NebuSec’s full exploit chain or its claimed impact.
Security briefing · October 29, 2026
What We Know About Telegram’s Android Call Attack
NebuSec says a flaw in Telegram for Android’s calling code could form part of a three bug chain that took control of a phone after its owner answered a call. The app update is available; the full chain remains unverified in public.
Released in September 2026, according to the source material.
A user interaction was required; NebuSec characterized the scenario as one-click, not zero-click.
No full public technical report independently documents all attack stages.
What NebuSec says happened
The reported risk depends on a chain of bugs. NebuSec’s description offers a possible route from a private Telegram voice call to administrator level access on an Android phone. Public evidence does not yet confirm each step or its claimed impact.
Why answering calls matters
If NebuSec’s account is accurate, an ordinary action—answering an incoming call—was the point at which a multi stage attack could proceed. That makes app updates and call controls practical safeguards while the evidence develops.
One click, as described
The owner had to answer the call. NebuSec did not describe an attack that succeeds without user interaction.
Android is the stated focus
NebuSec said it had no evidence that iOS, desktop, or group calls were directly affected. Shared code changes alone do not prove exploitability on those platforms.
No CVE reported
The source material reports no CVE or entry in the cited U.S. listings as of October 29. CVE only workflows may miss an app update tied to an unlisted issue.
From camera fix to public report
The source author’s review found a code correction in Telegram’s public Android source. The change supports the presence of a fix, but does not verify the complete exploit chain.
Shared library change
A similar correction appeared in the tgcalls library under the title “Fix camera rotation.”
Android source update
The review says the Android source update containing the correction appeared on this date.
Version 12.10.4
NebuSec identifies this Android release as fixed. The disclosed range runs from 8.6.2 through 12.10.3.
The source comparison found code that checked whether one field existed, then read a different field that could be absent.
The later version reads the field it checked. This indicates a correction in the call status handling code.
What the public record shows
A code change and a short demo
The comparison of versions 12.10.3 and 12.10.4 found the field handling correction. A short demonstration showed a call connecting before the victim phone returned to its home screen, according to the source author.
The complete chain and impact
The demo did not show the app or Android version. NebuSec had not published a technical write up detailing each bug or proving claimed access to messages, microphone, and camera.
“Now picking up a wrong call can get you hacked.” NebuSec’s October 29 post on X
NebuSec says it reported the issue to Telegram on September 26, after version 12.10.4 had appeared. Its CEO said Telegram acknowledged the report but did not consider the flaw capable of remote code execution; no CVE identifier or bounty followed. The source reports no public Telegram response as of October 29.
Update now; watch for findings
Check your Android version
Open Telegram Settings and check the version number at the bottom. Update to Android 12.10.4 or later.
Limit incoming calls
Set “Who can call me?” to My Contacts or Nobody, and decline calls from unfamiliar accounts. An unknown call is not automatically malicious.
Set a minimum app version
Define minimum Telegram versions for managed phones and rules for calls from unknown accounts. Do not rely only on CVE feeds.
Track technical advisories
Watch for details from NebuSec or Telegram on affected Android versions, other platforms, group calls, and the patch assessment.
Why Answering Calls Matters
If NebuSec’s description is accurate, the flaw made an ordinary action—answering an incoming call—the point at which a multi-stage attack could proceed. That matters because people may treat a call prompt as a routine app interaction. NebuSec characterized the reported scenario as one-click: the victim had to answer. It was not described as a zero-click attack that succeeds without user interaction.
The episode also highlights a visibility gap for organizations. The source material says the flaw has no CVE number, and there was no entry for it in the cited U.S. vulnerability listings as of October 29. Security processes that rely only on CVE feeds may not flag an app update tied to an issue disclosed without a CVE. For individuals, updating Telegram is the clearest immediate step; organizations can set minimum app versions for managed phones and define rules for calls from unknown accounts.
Products Worth Considering
Logitech MX Mechanical Full-Size Wireless Mechanical Keyboard, Tactile Quiet Switches, Backlit Keys, Bluetooth, USB-C, Multi-Device, Graphit
Logitech MX Master 4 for Mac, Ergonomic Bluetooth Mouse with Haptic Feedback, Ultra-Fast Scrolling, USB-C Charging, for MacOS, iPadOS, Windo
Apple MacBook Pro 16-inch (2021) – M1 Pro Chip, 10-Core CPU, 16-Core GPU, 16GB RAM, 1TB SSD, Space Gray
As an affiliate, we earn on qualifying purchases.
From Camera Fix to Disclosure
NebuSec’s disclosed range is Telegram Android 8.6.2 through 12.10.3, spanning March 2022 to September 2026. The company identifies version 12.10.4 as the fix. The source author’s review of Telegram’s public code found that the shared calling library, tgcalls, received a similar correction on April 21, 2026, in a change titled “Fix camera rotation.” The Android source update containing the correction appeared later, on September 24, according to that review.
The source material says Telegram’s shared call library is used by Android, iOS and desktop apps, and that The Hacker News reported the iOS app incorporated the change in May and the desktop app in July. That timing alone does not show those versions were exploitable. NebuSec said it had no evidence that iOS, desktop or group calls were directly affected. The disclosed concern is specifically Telegram for Android.
“Now picking up a wrong call can get you hacked.”
— NebuSec’s October 29 post on X
What the Public Evidence Shows
As of October 29, NebuSec had not published a technical write-up of the flaw, and its short demo did not show the Telegram or Android version running on the victim phone. The source author says the video showed a call connecting before the victim phone returned to its home screen, but that demonstration does not independently confirm the two additional bugs or the claimed access to messages, microphone and camera.
NebuSec said it had seen no real-world attacks. The source material also reports no CVE for the issue in the U.S. National Vulnerability Database and no related Telegram entry in the cited CISA known-exploited vulnerabilities catalog, dated October 28. Those absences do not prove that exploitation never occurred; they describe the public records checked at the time. The extent of any risk to other Telegram platforms or call types remains unconfirmed.
Update and Watch for Findings
Telegram users can check the version number at the bottom of the app’s Settings screen and update to 12.10.4 or later. Until updated, the source recommends limiting “Who can call me?” to My Contacts or Nobody and declining calls from unfamiliar accounts. NebuSec’s disclosure does not establish that every unknown call is malicious.
Further clarity depends on a public technical account from NebuSec or additional information from Telegram, including whether the company will explain its assessment and the patch. Users and administrators should watch for new technical details or a security advisory that identifies affected Android versions and clarifies whether other platforms or group calls are in scope.
Key Questions
What did NebuSec report?
NebuSec said a flaw in Telegram’s Android calling code could be combined with two other bugs to take control of a phone after its owner answered a call. The full chain has not been independently established in a public technical report.
Which Telegram version fixes the reported flaw?
NebuSec identified Telegram Android 12.10.4 as the fixed version. Users should update to that release or a later one.
Was this a zero-click attack?
No. The reported scenario required the victim to answer the call, so NebuSec described it as a one-click attack rather than one that works without user interaction.
Have attacks been confirmed in the wild?
NebuSec said it had seen no real attacks. The source material also reports no CVE listing or entry in the cited CISA catalog as of October 29, 2026; those facts do not establish whether an unreported attack occurred.
Are Telegram on iPhone and desktop affected?
The source material says NebuSec had no evidence that iOS, desktop or group calls were directly affected. The shared calling library received a correction, but that fact alone does not establish that those apps were exploitable.
Source: Thorsten Meyer AI
