A Telegram for Android flaw let attackers run code on your phone just by getting you to answer a voice call. Here's what happened and how to stay protected.
Picture this: your phone rings on Telegram. It's a voice call from someone. You pick up, say hello, and hang up a few seconds later. Normal, right? Well, according to security startup NebuSec, that single answered call could have been enough for an attacker to run code on your Android device. No shady file to download. No link to tap. Just an answered call.
That's the kind of thing that should make you pause for a second.
### What Actually Happened
NebuSec found a flaw in Telegram for Android that let an attacker execute code on a victim's phone once the victim answered a voice call. Here's the part that stings: the attacker didn't need anything fancy. An ordinary Telegram account was enough. No special access, no insider knowledge, no premium tools. Just a regular account and a phone number to call.
The flaw affected every version of the app from a certain point forward until Telegram patched it in version 12.10.4, which rolled out in late September. NebuSec went public with the details on October 29, giving the company time to push the fix out first.
### Why This One Feels Different
We're used to thinking about security in terms of what we click. Don't open that attachment. Don't tap that link. Don't install that APK from a random website. But this flaw skipped all of that. The trigger was answering a call, which is about as basic as phone behavior gets.
If you work with antidetect browsers, manage multiple accounts, or just spend a lot of time on messaging apps for business, this is worth paying attention to. The whole point of tools like the best antidetect browser is to keep your accounts and identities separated and secure. A flaw that lets someone run code on your device through a voice call undercuts that sense of control pretty quickly.
### The Fix and What You Should Do
Telegram moved fast here, which deserves credit. The patch landed in version 12.10.4. If you're on Android and you haven't updated, do it now. Open the Play Store, check your Telegram version, and update if you're behind.
A few practical steps:
- Update Telegram to version 12.10.4 or later right away
- Check your app version periodically, since patches don't install themselves
- Be cautious about answering voice calls from unknown accounts, even on apps you trust
- Keep your antidetect browser profiles and messaging accounts on separate, updated environments
> "The scariest vulnerabilities aren't the ones that require you to make a mistake. They're the ones that exploit the things you do every day without thinking."
That quote sums up why this flaw matters. Answering a call is muscle memory. You don't weigh the risks first. You just pick up.
### What This Means for Privacy-Focused Users
If you rely on antidetect browsers to manage multiple profiles, run e-commerce operations, or keep your digital identities separate, remember that your messaging apps are part of that same ecosystem. A compromised phone can expose everything running on it, no matter how clean your browser setup is.
So treat app updates as part of your security routine, not an afterthought. The best antidetect browser in the world won't protect you if the apps sitting next to it are running old, vulnerable code.
Telegram fixed this one quickly. But the lesson sticks around: on Android, staying current isn't optional. It's the baseline.
