Telegram fixes Android call flaw that could enable phone takeover
Technology · First reported 29 Oct, 11:39 · Updated 15:51
A security company says a flaw in Telegram for Android could be combined with two other bugs to take control of a phone after its user answered a call. Telegram fixed the flaw in version 12.10.4; the company said it had not seen it used in real attacks.
- NebuSec said an attacker with an ordinary Telegram account could exploit the flaw after a user answered a voice call, chaining it with two other bugs to gain control of an Android phone.
- Telegram fixed the flaw in Android version 12.10.4, released in September; the article advises users to update or set call privacy to “Nobody.”
- NebuSec said it had not seen the flaw used in real attacks. Its report to Telegram came after version 12.10.4 shipped, and the article says no CVE had been assigned as of October 29.
Summary written by Lux AI from 2 articles
Key facts
- Affected app
- Telegram for Android, versions 8.6.2 through 12.10.3, according to NebuSec.
- Fixed version
- 12.10.4.
- Reported condition
- The victim had to answer a Telegram voice call.
- Disclosure
- NebuSec reported the flaw to Telegram on September 26 and disclosed it on October 29.
- Observed attacks
- NebuSec said it had not seen the flaw used in real attacks.
Source spectrum
Far left
Left
Lean left
Centre
Lean right
Right
Far right
Left 0 · Centre 2 · Right 0 of 2 rated sources
All coverage
Coverage over time
LeftCentreRight
Articles per hour since first reported, by side.
Ownership
- Unknown 50% (1)
- Corporation 50% (1)
Share of the 2 sources by owner type.