TL;DR
Get the latest gadgets delivered free with Prime
- Fast, free delivery on millions of items
- Prime Video, Amazon Music and more included
- Member-only deals all year
Security startup NebuSec says a flaw in Telegram for Android call code could be combined with two other bugs to take control of a phone after its owner answered a call. Telegram’s version 12.10.4, released in September, contains a correction to the call code, but the full attack chain has not been independently documented and NebuSec says it has seen no real attacks.
Security startup NebuSec disclosed a flaw in Telegram for Android on October 29, saying an attacker could use it as part of a chain of bugs to take control of a phone after its owner answered a call. The call-code correction is in Telegram version 12.10.4, released in September, according to NebuSec; the company says it has seen no real-world attacks.
NebuSec says the flaw affected Telegram for Android versions 8.6.2 through 12.10.3, spanning roughly March 2022 to September 2026. The call-code bug was one part of a chain, not a complete phone takeover by itself, according to the company’s chief executive, Eten Zou, who described the issue to The Hacker News. Zou said a second bug exposed information that helped an attacker escape the Telegram app into Android, while a third vulnerability gave the attacker root access, or full administrator control.
NebuSec said the attacker needed a regular Telegram account and the victim had to answer a private voice call. The company told The Hacker News that it tested the chain on ARM64 phones, a processor architecture used by most modern Android devices. It has not published a technical write-up of the flaw or the other bugs, and its 22-second demonstration video does not identify the Telegram or Android version on the victim phone. Those limits mean the full chain currently rests on NebuSec’s account and demonstration.
The researcher says Telegram acknowledged a report submitted on September 26, but Zou told The Hacker News that the company did not consider the bug capable of remote code execution. NebuSec says no vulnerability identifier, known as a CVE, was assigned and no bounty was paid. Telegram had not issued a public response in the source material. NebuSec says it has no evidence of actual attacks.
Android security · Reported October 29, 2026
Is Answering The Call The Risk?
Understanding Telegram’s Android flaw: NebuSec says a call-code bug could join two other vulnerabilities in an attack chain. The claimed takeover required the recipient to answer a private call; the full chain has not been independently documented.
Telegram for Android, released in September 2026
NebuSec says a victim had to answer a private voice call.
NebuSec says it has no evidence of real-world attacks.
According to NebuSec
March 2022 to September 2026
Information exposure and root access
As described in the report
01 / The reported chain
One call bug, three steps claimed
NebuSec described the call-code flaw as one part of a larger chain, not a standalone phone takeover. The account and demonstration have not yet been independently verified.
Answer a private call
The victim must answer. The report describes a one-click attack claim, not a zero-click attack.
Call-code flaw
A MediaState message handling issue is the defect NebuSec says begins the chain.
Information exposure
A second bug allegedly exposed information that helped escape the Telegram app.
Root access
A third vulnerability allegedly gave full administrator control of the phone.
“The call bug alone was not enough.”Eten Zou, NebuSec chief executive · The Hacker News
02 / What changed
A field mismatch in call status
The reported defect concerns status messages exchanged during calls. Telegram’s MediaState can describe microphone mute, camera activity, and video rotation.
According to the source author’s public-code comparison, the program checked that a rotation value existed, then read a separate video-state field that the message did not have to include.
The source author says the corrected Android code reads the rotation field. NebuSec says this version contains the call-code correction.
03 / Evidence and limits
Serious claim. Incomplete public record.
The available evidence supports installing the fix as a practical precaution. It does not establish every claimed impact or the chain’s reach.
What the report says
- NebuSec tested the chain on ARM64 phones, an architecture used by most modern Android devices.
- The company says a regular Telegram account and an answered private voice call were required.
- NebuSec says Telegram acknowledged a report submitted September 26.
- NebuSec says it has seen no real-world attacks.
What remains unverified
- No technical write-up details the call flaw, information leak, or root exploit.
- A 22-second video does not identify the Telegram or Android versions or show each step.
- It is unclear how broadly the chain works or whether the other two bugs remain usable.
- No public Telegram response appears in the source material; no bounty or CVE was reported.
04 / Practical response
Update, check, limit calls
The correction is available. Users and organizations can reduce exposure while the chain’s scope remains uncertain.
Install 12.10.4 or later
Check the version shown at the bottom of Telegram’s Settings screen, then update the app.
Restrict who can call
NebuSec’s advice, as relayed in the source material, is to set “Who can call me?” to My Contacts or Nobody and decline unfamiliar calls.
Set a minimum version
Check Telegram versions on managed phones and apply a clear app-update policy, including for reports without a CVE.
05 / Key questions
What Android users should know
What did NebuSec report?
A Telegram for Android call-code flaw that it says could combine with two other bugs to take control of a phone after the owner answered a private call.
Which version fixes the reported flaw?
NebuSec says Telegram for Android 12.10.4, released in September 2026, contains the correction. Check Settings and update.
Was this a zero-click attack?
No. NebuSec says the victim had to answer the call, and the claimed takeover also needed two additional bugs.
Were attacks confirmed?
NebuSec says it has no evidence of actual attacks. The full chain and its real-world use remain unconfirmed in the available material.
Why Call Access Matters
A call can create a route into software that handles real-time audio and video, alongside the messaging features users may associate most closely with Telegram. If NebuSec’s account of the chain is accurate, the user’s decision to answer a call would have been the necessary interaction before the other bugs could be used. That makes this a one-click attack claim, rather than a claim that a phone could be compromised without any user action.
The potential consequences described by NebuSec are serious: root access could expose messages and allow access to the phone’s microphone and camera. Those outcomes are claims about the complete chain, however, and the company has not released enough technical detail for outsiders to reproduce or independently assess them. The available evidence supports treating the Android update as a practical precaution without treating every claimed impact as independently established.
The missing CVE also has implications for organizations. Security teams that rely on vulnerability databases to identify software needing attention may not see this report there. For managed work phones, a minimum supported Telegram version and a clear app-update policy can help address software issues that do not appear in those feeds. Individual users can check the version shown at the bottom of Telegram’s Settings screen and restrict who can call them while they update.
Products Worth Considering
DJI Osmo Pocket 3 Creator Combo Vlogging Camera with Mic 2, 1 CMOS, 4K/120fps, 3-Axis Stabilization, 128GB Card
DJI Osmo Pocket 3 Vlogging Camera with 1-Inch CMOS Sensor and 4K Video
Samsung Galaxy Tab S10 FE 128GB Wi-Fi Android Tablet, Blue
As an affiliate, we earn on qualifying purchases.
How Telegram Changed the Call Code
The reported defect concerns status messages exchanged during a call. Telegram’s Android code handles a message type called MediaState, which can report information such as whether a microphone is muted, whether a camera is active and how video is rotated. In version 12.10.3, according to the source author’s comparison of Telegram’s public code, the program checked that a rotation value was present but then read a separate video-state field that the message did not have to include. Version 12.10.4 reads the rotation field instead.
The source author also says Telegram’s shared call library, tgcalls, received the same correction on April 21, 2026, in a change titled “Fix camera rotation.” The Android source change appeared on September 24, 156 days later, according to the author’s calculation. The Hacker News reported that iOS received the change in May and desktop in July. The available material does not establish that those apps were exploitable, and NebuSec said it had no evidence that iOS, desktop or group calls were directly affected.
As of October 29, the source author reported finding no CVE entry in the U.S. National Vulnerability Database and no Telegram entry in the CISA catalog of known exploited vulnerabilities, using the catalog dated October 28. Those absences do not establish that the flaw was harmless or exploited; they describe what those public records contained at that time. The report also says Google’s Project Zero wrote in 2018 that answering a call is “a reasonable action to expect a user to take.”
“Now picking up a wrong call can get you hacked.”
— NebuSec, in its October 29 post on X
What the Evidence Does Not Show
The full attack chain has not been independently verified in the material available as of October 29. NebuSec has not published a technical report detailing the call flaw, the information-leak bug or the root exploit. Its video shows a phone after a call connects, but does not identify the software versions involved or show the chain’s individual steps.
It is also unclear whether the other two bugs remain usable, how broadly the reported chain works across Android devices, or whether any attackers used it before the fix. NebuSec says it has seen no real attacks. The report provides no public Telegram statement, and the reason the company did not assign a CVE or pay a bounty is described through Zou’s account rather than a Telegram response. No evidence in the source material establishes direct exposure of Telegram’s iOS or desktop apps or its group calls.
Update Android Apps and Watch
Android users should update Telegram to version 12.10.4 or later and confirm the installed version in Settings. Until updated, NebuSec’s advice, as relayed in the source material, is to limit “Who can call me?” to My Contacts or Nobody and to decline calls from unfamiliar people. Organizations can check app versions on managed phones and set a minimum version requirement.
The next useful developments would be a technical report from NebuSec, a public response from Telegram, or independent analysis that can establish the affected conditions and the claimed attack chain. The source material does not provide a date for any of those steps. For now, the fix is available, while the scope and real-world use of the reported chain remain unconfirmed.
Key Questions
What did NebuSec report?
NebuSec reported a flaw in Telegram’s Android call code that it says could be combined with two other bugs to gain control of a phone after the owner answered a private call.
Which Telegram version fixes the reported flaw?
NebuSec says the correction is in Telegram for Android 12.10.4, released in September 2026. Users should check Settings for their installed version and update.
Was this a zero-click attack?
No. NebuSec’s account says the victim had to answer the call, so its description involves a user action. The call-code flaw also required two additional bugs for the claimed phone takeover.
Has NebuSec confirmed attacks in the wild?
NebuSec says it has seen no real-world attacks. The source material reports no CVE entry or listing in CISA’s known exploited vulnerabilities catalog as of October 29, 2026.
Are Telegram on iPhone and desktop affected?
The source material says NebuSec has no evidence that the iOS or desktop apps, or group calls, were directly affected. It does not establish whether those versions could be exploited.
Source: Thorsten Meyer AI
