Security firm NebuSec disclosed on October 29 a flaw chain in Telegram for Android that could give an attacker full control of a phone when the victim answers a private voice call. Telegram fixed the underlying bug in version 12.10.4 in late September, and no in-the-wild exploitation has been reported.
How the Telegram Voice Call Attack Chain Works
NebuSec says the flaw can be chained with an information-leak bug to escape the Telegram app. A third step, an Android root exploit, then gives the attacker full control of the device, including messages, the microphone and the camera.
The attacker needs only an ordinary Telegram account. The victim must answer the call, which means the first step is an ordinary call from an ordinary account.
Affected Builds Span Four Years
The vulnerable builds run from Telegram for Android 8.6.2 through 12.10.3. According to the report, those builds cover March 2022 to September 2026. The confirmed architecture is ARM64, and the issue concerns private voice calls. NebuSec found no evidence yet of impact on iOS, desktop or group calls.
Telegram Patched in September, NebuSec Disclosed in October
Telegram shipped the fix in version 12.10.4 in late September. NebuSec published its disclosure on October 29, after the patched release had been available for about a month. Users who have updated to 12.10.4 or later are outside the affected range.
The gap between fix and disclosure means the details became public only after a corrected build existed, though phones that never updated remain exposed.
Escape From the App Requires Additional Bugs
The reporting is explicit that the Telegram flaw alone does not deliver full device control. The chain depends on an information leak to defeat protections and an Android root exploit to take over the device. Those additional components are separate from Telegram’s code, and the report does not say which root exploit or leak NebuSec used.
Potential Impact on Unpatched Android Phones
On unpatched Android phones, the chain could amount to full device compromise. The reporting describes access to messages, the microphone and the camera as the outcome. No in-the-wild exploitation has been reported, so the described impact stays potential rather than observed.
Scope Limits Reported So Far
The known limits are narrow in platform terms. NebuSec’s evidence covers Android and private voice calls on ARM64. Whether the same mechanism affects other Telegram clients or call types has not been established, and the report treats the absence of impact on iOS, desktop and group calls as “no evidence yet” rather than as confirmed safety.
Telegram’s fix in 12.10.4 is the stated remedy: update Telegram for Android to 12.10.4 or later. The disclosure illustrates a pattern in which a messaging-app bug serves as only the first stage of a longer compromise, with the remaining stages supplied by flaws in the operating system. That chain structure explains why the app-level flaw alone does not determine the final severity, and why NebuSec frames the risk around the full sequence rather than the Telegram bug in isolation.
What Telegram and NebuSec Have and Have Not Established
The timeline is the clearest part of the record. Builds from 8.6.2 to 12.10.3 are affected, the fix landed in 12.10.4 in late September, and NebuSec went public on October 29. The unknowns are larger. The reporting does not say how many users still run affected builds, which root exploit completes the chain or whether any attacker has tried it.
NebuSec’s confirmation covers ARM64 devices. The chain also depends on the victim accepting the call, so the attack cannot proceed silently on its own.
The disclosure covers a long span of releases. The affected range begins at version 8.6.2 and ends at 12.10.3, the last build before the September fix. NebuSec describes the outcome as full control of the phone, including messages, the microphone and the camera.
