Telegram fixed a remote code execution flaw in its Android app after the security firm V12 posted a video showing a message from a bot opening the Calculator app on a phone. Telegram said it fixed the bug on November 11 and deployed the fix to all users on November 12.
What V12 Demonstrated in Its Telegram Widgets RCE Video
V12 labeled its demonstration “Telegram Widgets RCE.” In the video, a message from a bot launched the Calculator app on an Android phone. The firm claimed that any Telegram message could become a route to remote code execution.
Hash Published Instead of Technical Details
V12 did not release technical details or exploit code. It published only a SHA-256 hash. Publishing a hash lets a researcher prove later that it held specific material at a given time without revealing the contents. The approach leaves the public without a description of how the flaw works.
Telegram’s Response and Fix Timeline
Telegram confirmed the issue and said it had fixed the bug on November 11, the day of the V12 demonstration. The company rolled the fix out to all users on November 12, according to Securityonline.
No CVE and No Reported Attacks
No CVE identifier has been assigned to the flaw, and no attacks have been reported. Without a CVE or published details, the severity and exact conditions of the bug rest on V12’s claim and the demonstration video.
A Second Android Code Execution Claim in Two Weeks
The disclosure follows another code execution claim against Telegram for Android by about two weeks. NebuSec reported a voice-call flaw on October 29, and Telegram fixed it in version 12.10.4. That makes the V12 claim the second such report in roughly the same period.
Potential Reach of a Single-Message Attack
The potential impact is zero-click code execution through a single message. The sources do not confirm that the flaw required no interaction from the target, since V12 has not published details, so the zero-click description reflects the potential rather than a verified property. The demonstration showed a bot message triggering the Calculator app, a common proof-of-concept target that shows the ability to launch a program without producing a harmful payload.
The reporting rests on one outlet, Securityonline, which relays V12’s video, the hash and Telegram’s confirmation. Telegram has not described the technical cause. Users are advised to update the app, though the company says the fix already reached all users on November 12.
The pattern of two reported Android code execution flaws within a short period draws attention to the app’s attack surface, which includes bots and widgets. The V12 claim that any message could carry the exploit is unverified, and Telegram’s confirmation covers only that a bug existed and was fixed. Until V12 or Telegram releases further detail, the specifics of the Widgets component involved remain unpublished.
Sources and What Remains Unconfirmed in the V12 Claim
Securityonline reported the V12 demonstration and Telegram’s response. The report does not include details of how the Widgets component processes bot messages. V12’s hash gives it a way to prove later that it held the exploit, and Telegram’s statement confirms only that the bug was real and has been fixed.
Three points separate the confirmed from the claimed. Telegram confirmed the bug and the fix dates of November 11 and November 12. V12 claimed that any Telegram message could become remote code execution, which no one has verified. The video shows one demonstration, a bot message that opened the Calculator app on an Android phone.
With no CVE and no technical write-up, researchers cannot yet compare the flaw with earlier Telegram bugs, including the voice-call issue NebuSec reported on October 29.
