Update Telegram for Android Now: Answering a Call Could Trigger Code Execution

Telegram for Android users should update to version 12.10.4 or later now because researchers disclosed a reported attack chain that can start when a target answers a private voice call. The disclosure applies to Telegram for Android versions 8.6.2 through 12.10.3, while available reporting says the affected chain does not directly apply to iOS, Telegram desktop apps, or group calls.

The practical risk is serious even though the trigger is limited. NebuSec said the reported chain can combine a Telegram call flaw, an information leak, and an Android root exploit to reach full device compromise. Users should install the available update, avoid answering unexpected private calls until they confirm their version, and review which contacts can call them.

What is the Telegram Android security flaw?

The Telegram Android security flaw is a reported private voice-call vulnerability that could allow an attacker with an ordinary Telegram account to execute code after a target answers an incoming private call. NebuSec publicly disclosed the issue on October 29, 2026, including a demonstration of the reported attack path. NebuSec’s original disclosure describes the call-based trigger.

The reported issue matters because a call can appear routine, particularly when a user receives frequent messages or calls through Telegram. The attack does not reportedly require the target to install a separate app or open a visible file after answering. That said, the available information describes a chain rather than a single isolated bug, so the reported full-compromise outcome depends on the additional information leak and Android root exploit working together.

Telegram users should treat unexpected private calls as a security concern until the app is updated. Users who need to keep Telegram available for family, work, or community groups can reduce exposure by limiting who is allowed to call them rather than disabling the service entirely.

Which Telegram for Android versions are affected?

Telegram for Android versions 8.6.2 through 12.10.3 are reportedly affected, while version 12.10.4 shipped with the fix in late September 2026. Technical reporting based on the researcher’s findings identifies that version range and says the issue was validated on ARM64 Android phones. The technical reporting on the disclosure also states that there was no evidence of direct impact on iOS, desktop apps, or group calls.

The version range is important because an Android phone can continue using an older Telegram build when automatic app updates are disabled, delayed, or restricted to Wi-Fi. A user who installed Telegram months ago should not assume the app updated in the background. The safest response is to check the installed version directly, even if Google Play shows no obvious update notification.

Telegram’s Android exposure also shows why app updates deserve the same attention as operating-system updates. Users who already review software update security incidents should apply the same principle here: confirm that the installed build includes the vendor’s available fix rather than relying on an assumed update.

How can you check and update Telegram safely?

Telegram for Android users can check the installed app version at the bottom of Telegram Settings, then update through the official app store if the version is below 12.10.4. Lookout advised users to move to version 12.10.4 or later after the disclosure. Lookout’s mobile-security advisory provides the mitigation guidance and version-check location.

1. Open Telegram on the Android phone.
2. Open Telegram Settings and scroll to the bottom to find the installed version.
3. Open the official app store used to install Telegram.
4. Install the Telegram update if the installed version is 12.10.3 or earlier.
5. Reopen Telegram and confirm that the version is 12.10.4 or later.
6. Review Telegram call privacy controls before answering calls from unfamiliar accounts.

Telegram users should install updates only through the official app store or a trusted, verified distribution channel. Do not download an APK sent in a Telegram chat, even if the sender claims it is an emergency security patch. Attackers often use urgent update messages to persuade users to install unrelated malicious software.

Stop and contact Telegram support or your device maker’s support if the update repeatedly fails, the app behaves unusually after updating, or the phone shows signs of a wider compromise. A normal user should not attempt root-level repairs or install unverified security tools to investigate this issue.

Why does answering a private Telegram call matter?

Answering a private Telegram call matters because the reported attack requires that action to trigger the vulnerable call path. Declining an unexpected private call prevents this specific reported trigger, which gives users a practical short-term defense while they install version 12.10.4 or later.

The limitation is equally important: declining calls is not a replacement for updating. A user can accidentally answer a call, and contact names or profile images can be misleading if an attacker has compromised or impersonated an account. The durable protection is the fixed Telegram version, while restrictive call settings reduce the number of unsolicited attempts that reach the phone.

Telegram users should be especially cautious when a caller asks them to answer immediately, move a conversation to a private call, or install an attachment after the call begins. Similar social engineering pressure appears in other account attacks, including cases involving hijacked browser extensions, where a familiar-looking prompt can conceal an unsafe action.

How serious is the reported attack chain?

The reported attack chain is serious because NebuSec said the combined flaws could lead to full Android device compromise, including access to messages, the microphone, and the camera. The described outcome goes beyond a Telegram account takeover because root-level Android access could affect data and hardware permissions outside the app.

The available evidence also has limits. NebuSec said it validated the issue in private calls on ARM64 Android phones, and no CVE identifier or in-the-wild exploitation had been reported at the time of the October 29 disclosure. Those details do not reduce the need to update, but they distinguish a reported and tested research chain from a publicly confirmed mass exploitation campaign.

Users who answered an unexpected private call on an unpatched version should update first, then watch for unusual device behavior such as unfamiliar apps, unexplained permission prompts, or unexpected microphone and camera activity. Users who handle sensitive work, financial, medical, or personal information should consider changing important account passwords from a separate trusted device if they have a specific reason to suspect compromise.

How can Telegram call privacy reduce exposure?

Telegram call privacy controls can reduce exposure by limiting incoming calls to “My Contacts” or “Nobody.” Lookout specifically recommended those settings as a temporary risk-reduction measure while Android users update, because the reported chain begins with an unsolicited private call reaching and being answered by the target.

Telegram call privacy is a mitigation, not a fix. A contacts-only setting still permits calls from saved contacts, and a trusted contact account could be impersonated or compromised. For most users, “My Contacts” offers a practical balance between availability and protection, while “Nobody” is the stronger short-term option for people who do not need Telegram calls.

Telegram users should also consider whether Telegram calls are necessary for daily communication. Restricting app permissions and call access is useful across services, particularly as more apps connect to personal information, as shown by expanding calendar and contacts permissions in other platforms.

What should you do if you answered a suspicious Telegram call?

Telegram users who answered a suspicious private call should update to version 12.10.4 or later, restrict call privacy, and review the phone for unfamiliar apps or unexpected permission requests. The reported attack requires answering the call, so users who did answer on versions 8.6.2 through 12.10.3 have a stronger reason to take those precautions promptly.

Users should avoid deleting evidence or installing unverified cleanup apps if they suspect a serious compromise. Screenshots of unusual prompts, the caller’s Telegram account details, and the approximate call time can help support staff assess what happened. If the phone contains work-managed data, contact the employer’s IT or security team before changing device settings that could erase useful evidence.

Android users should stop at professional assistance if they see repeated unauthorized camera or microphone activity, unfamiliar device-administrator controls, unexpected root-related prompts, or account sessions they cannot explain. A security professional or device maker can help evaluate a suspected device compromise without relying on risky do-it-yourself root tools.

FAQ

Does the Telegram Android flaw affect iPhones?

Telegram’s reported Android call flaw does not have evidence of directly affecting iOS in the available disclosure. iPhone users should still keep Telegram updated because routine app updates address other bugs and security issues.

Can declining a Telegram call prevent the attack?

Declining an unexpected private Telegram call prevents the specific reported trigger because the target must answer the call for the chain to begin. Updating to Telegram 12.10.4 or later remains necessary because declining calls is only a temporary behavior-based defense.

What Telegram version fixes the Android call flaw?

Telegram for Android version 12.10.4 or later contains the reported fix. Check the version at the bottom of Telegram Settings, then install the latest available update through the official app store.

Were Telegram group calls affected by the flaw?

Telegram group calls had no direct evidence of impact in the researcher’s reported findings. The disclosed issue was validated in private calls on ARM64 Android phones, so users should focus on updating the Android app and limiting private incoming calls.

Has the Telegram Android flaw been exploited in the wild?

No confirmed in-the-wild exploitation had been reported when the flaw was disclosed on October 29, 2026. The absence of a public exploitation report does not make older Telegram versions safe, because the reported chain has been publicly described and a fix is available.