Telegram Android Bug Allowed Remote Code Execution via Voice Calls
Security startup NebuSec discovered a Telegram for Android flaw that could let attackers take over a phone through a voice call.
A security flaw discovered in Telegram for Android could be chained with two other vulnerabilities to grant full remote control over a victim's smartphone. According to security startup NebuSec, the exploit was triggered as soon as the user answered an incoming voice call.
- The vulnerability was discovered by security startup NebuSec.
- Attackers only required an ordinary Telegram account and a chain of three bugs.
- Telegram patched the issue in app version 12.10.4 released in late September.
- NebuSec publicly disclosed the details on October 29.
Technical Breakdown of the Flaw
Researchers explained that the vulnerability alone was not enough to compromise the device. It had to be chained with two additional bugs to successfully execute malicious code and take over the victim's phone entirely during a routine voice call.
The Telegram development team moved quickly to address the issue. The vulnerability was effectively resolved in version 12.10.4 of the Android application, which rolled out in late September. NebuSec later disclosed the findings on October 29.
What This Means for Users
Android users are strongly advised to ensure their Telegram application is updated to the latest version. Keeping messaging apps patched is crucial to preventing complex exploit chains and maintaining mobile device security.
Source: The Hacker News
