Is Answering The Call The Risk? What We Know About Telegram On Android

🔍 Read the full analysis: Is Answering The Call The Risk? What We Know About Telegram On Android on ThorstenMeyerAI.com

Age 18–24?Offer from Amazon

Prime made for students and young adults

• Fast, free delivery for dorm and study essentials
• Prime Video and Amazon Music included
• Member-only deals

Try Prime for Young Adults →Free trial for eligible 18–24 year olds

As an affiliate, we earn on qualifying purchases.Hide

Security startup NebuSec disclosed a flaw in Telegram for Android on Oct. 29, saying an attacker could exploit it after a user answered a call and combine it with two other bugs to gain control of the phone. The company says Telegram fixed the call-code issue in version 12.10.4, released in late September, and that it has seen no real-world attacks; the full attack chain has not been independently documented in a public technical report.

NebuSec said the affected range was Telegram for Android versions 8.6.2 through 12.10.3, spanning March 2022 to September 2026. The flaw was in code used to handle voice calls. According to the company’s chief executive, Eten Zou, the call bug alone was not enough to take over a device: it had to be combined with a second bug that exposed information and a third Android exploit that provided administrator-level, or root, access.

NebuSec says its demonstration worked during private voice calls on ARM64 phones, a processor architecture used by most current Android phones. The company’s short video shows a call connecting before the victim phone returns to its home screen, but does not identify the Telegram or Android version used. NebuSec said an attacker needed an ordinary Telegram account. These details are company claims; the complete exploit chain has not been laid out in a public technical write-up.

A review of Telegram’s publicly available Android source code by ThorstenMeyerAI.com found a change between versions 12.10.3 and 12.10.4 in the handling of a video-rotation value during calls. In the earlier code, the app checked that one field was present but read a different field that might be absent; the later code reads the checked field. That supports the existence of a relevant code correction, but does not by itself establish that the complete takeover NebuSec describes worked as claimed.

Why Answering a Call Matters

The reported weakness matters because a call can arrive from someone a user does not know, and answering is a routine action. If NebuSec’s account of the exploit chain is accurate, the call would have served as the entry point for a sequence that could reach beyond Telegram and compromise the Android device. The company describes this as a one-click attack: the victim must answer, so it is not a zero-click exploit.

For users, the immediate practical steps are to update Telegram and limit incoming calls from unknown people while using an earlier version. For organizations, the case also highlights a tracking gap: according to the source material, the flaw has no CVE identifier, so security processes that rely only on CVE feeds may not flag it. The claimed impact is serious, but the lack of a public technical account limits independent assessment.

Popular right now

Bose QuietComfort Wireless Bluetooth Headphones with Active Noise Cancellation, Mic, USB‑C Charging, Deep Bass, 24‑Hour Battery – White Smok

AmazonView Latest Price

Breville BES870XL Barista Express Espresso Machine, Brushed Stainless Steel

AmazonView Latest Price

De'Longhi Rivelia Fully Automatic Espresso Machine with Milk Frother, White

AmazonView Latest Price

As an affiliate, we earn on qualifying purchases.

The Fix Predates Disclosure

NebuSec said it reported the issue to Telegram on Sept. 26, shortly after version 12.10.4 appeared. Zou told The Hacker News that Telegram acknowledged the report but did not consider the bug capable of enabling remote code execution. According to Zou, no CVE was assigned and no bounty was paid. The source material says it found no public Telegram statement responding to the disclosure.

There is also an earlier change in Telegram’s shared call library, tgcalls. The account says the library received the same correction on April 21, 2026, under the change title “Fix camera rotation,” while the corrected Android source appeared 156 days later. The Hacker News reported that iOS incorporated the change in May and desktop in July. The available information does not show that those versions were exploitable; NebuSec reported its confirmed testing on Android.

As of Oct. 29, the U.S. National Vulnerability Database had no CVE entry for the issue, and the Cybersecurity and Infrastructure Security Agency’s known-exploited-vulnerabilities catalog, dated Oct. 28, listed no Telegram entry. Those absences do not prove that the flaw was never exploited; they show that it was not recorded in those sources at the time cited.

“Now picking up a wrong call can get you hacked.”

— NebuSec, in its Oct. 29 post on X

What the Public Evidence Shows

The largest open question is whether the full three-bug chain works as NebuSec described. The company has not published a technical write-up in the material available as of Oct. 29, and the demonstration does not identify the victim phone’s software versions. The source account says it could not independently verify the other two bugs or test whether the chain works against a fully updated Android phone.

NebuSec says it has seen no real attacks, but that is not proof that no one used the flaw. There is no CVE entry in the cited databases, and no public Telegram response was found in the source material. The evidence also does not establish whether older versions of Telegram for iOS or desktop, or group calls, were vulnerable; the Android finding should not be extended to those products without further evidence.

Update and Watch for Verification

Android users should check Telegram’s version in the app settings and install 12.10.4 or later. Those unable to update immediately can reduce exposure by setting “Who can call me?” to My Contacts or Nobody and declining calls from unknown accounts, as the source material advises. Organizations should consider enforcing a minimum app version on work phones rather than relying exclusively on CVE alerts.

The next key development would be a detailed technical account from NebuSec or a public response from Telegram that clarifies the report, the other bugs in the alleged chain and the scope of affected devices. Until then, the Android code comparison supports the existence of a fix, while the extent and real-world use of the claimed attack remain unsettled.

Key Questions

What is the Telegram Android flaw?

NebuSec says a bug in Telegram’s Android call-handling code could be combined with two other bugs to take control of a phone after the user answered a call. The complete chain has not been published in a technical report.

Which Telegram version fixes the reported issue?

The cited fix is in Telegram for Android 12.10.4. Users should install that version or a later one and check the app’s version in its settings.

Does answering any Telegram call hack a phone?

No. The report does not show that every call or every answered call causes a compromise. NebuSec describes a specific attack that required additional bugs, and the company has not published enough technical detail for independent confirmation.

Has the flaw been used in real attacks?

NebuSec says it has seen no real attacks. That statement does not establish that exploitation never occurred, and the source material reports no public evidence resolving the question.

Are Telegram on iPhone and desktop affected?

The reported testing was on Android. The available information does not establish that iOS, desktop or group calls were exploitable; a shared call-library change alone is not proof of exposure.

Source: ThorstenMeyerAI.com