Telegram's call bug proves your messenger is the real front door

Which app on your phone would you trust to be ready for strangers? Probably the one built to talk to strangers all day. That is precisely the problem: a messenger has to accept calls, files and data from people you have never met, and this week Telegram showed what happens when that door is left ajar.

According to The Hacker News, the security firm NebuSec demonstrated code execution through an answered Telegram for Android voice call, and the flaw was fixed in version 12.10.4. Other coverage, such as Total Security, says the bug could be chained with two other vulnerabilities to take full control of the victim's phone once they picked up. Portuguese outlet Tugatech adds that it sat in the app for four years undetected.

We should be careful about what the documentation does not say. The snippets we have don't tell us whether anyone exploited this in the wild, and we won't guess. What they do describe is a proof of concept in which, as Space Money summarizes it, the person didn't need to do anything beyond accepting the call.

The scariest part is how ordinary the trigger is

Most of us have a mental model of phone hacking that involves doing something dumb: tapping a shady link, installing a sketchy APK, entering a password on a fake page. This flaw breaks that model. Answering a call is the most natural gesture a phone has, and no amount of "being careful" protects you from a button you were always supposed to press.

That changes the advice. For years, security tips boiled down to user vigilance. Here vigilance is nearly useless, and the only real defense is on the software side: the patch.

Messaging apps are the new perimeter, whether we like it or not

Think about what a modern messenger does: it handles images, links, voice streams and call setup data, much of it coming from untrusted senders. Every one of those is code that can contain a mistake. In our view, that makes chat apps a more attractive target than the operating system itself, because they are installed everywhere, always on and open to anyone with your number or username.

There is a broader backdrop, too. InfoMoney reports that AI is surfacing software flaws so fast that engineers are racing to fix them before hackers exploit them, with Google fixing more serious flaws this year than in the previous eight years combined. We can't say AI found this Telegram bug, and nothing in the documentation suggests it. But it's reasonable to expect more disclosures like this one, not fewer, and a four-year-old bug coming to light now may be a sign that old code is being looked at harder than ever.

Update now, and stop grading apps on reputation

Telegram's own support page describes it as a cloud-based messenger focused on security and speed. That's the pitch, and a bug like this has little to do with it. Reputation tells you how a company talks; the version number tells you whether you are exposed.

The other side of the story is Android's update habits. Android Authority notes that 43.6% of active devices still run Android 13 or older. This fix, though, shipped in the app itself (version 12.10.4), not in an operating system release. In our reading, that means the one thing in your control is a few taps, not a wait for your phone maker.

So our recommendation is simple. Check that Telegram for Android is on 12.10.4 or later. Turn on automatic updates for your messengers, since they are the apps most exposed to strangers. And if you don't need voice calls in a given app, consider whether you want that feature accepting connections at all.

Our verdict: the lesson isn't "Telegram is unsafe." Any messenger with calls could have a bug like this. The lesson is that trusting a brand is a weaker strategy than updating on day one. Patch first, admire the reputation later.