Telegram has patched an Android app vulnerability that security startup NebuSec said could be combined with two additional bugs to compromise a victim's phone after they answered a voice call. According to the report, the attack required only a standard Telegram account. Telegram addressed the issue in version 12.10.4 of its Android app, released in late September, and the researchers disclosed the flaw publicly on 29 October.

What happened

Based on the reported findings, the Telegram for Android flaw was not described as a standalone full-device takeover. Instead, NebuSec said it could be chained with two other vulnerabilities to achieve remote code execution and ultimately full control of a target device. The trigger condition described in the report was that the victim answered a Telegram voice call.

The source indicates that Telegram has already released a fix in Android version 12.10.4. The available information does not confirm whether exploitation was observed in the wild, and businesses should avoid assuming that public disclosure automatically means widespread active attacks. However, the report does show that mobile messaging apps can become an entry point into business devices when employees use them for operational communication.

Why it matters for European businesses

For many SMEs and distributed teams, messaging apps are part of day-to-day business communication, including customer contact, supplier coordination and internal operations. A vulnerability tied to answering a voice call is notable because it lowers the barrier for social engineering: employees may view a call as routine and answer without the same caution they would apply to links or attachments.

If a business allows Telegram on Android work devices or in bring-your-own-device environments, a successful compromise could create wider security risks beyond the app itself. Depending on device permissions and how the phone is used, attackers may potentially gain access to business chats, stored files, authentication messages, contact networks or connected corporate services. That can affect incident response, data protection and mobile device security policies.

This is particularly relevant for European companies that rely on mobile-first teams, remote work or informal communication stacks. Even where Telegram is not an approved enterprise platform, it may still be used operationally by sales teams, founders, support staff or regional partners.

Who may be affected

• Businesses using Telegram on Android devices for internal or external communication.
• SMEs with BYOD policies where employee-owned Android phones access company email, files or admin tools.
• Teams handling sensitive conversations, including founders, operations staff, sales teams and support teams.
• IT and security teams responsible for mobile device management, app update compliance and incident response.
• Regulated organisations where a compromised employee device could create broader data protection or security concerns.

What companies should consider

• Confirm app versions: Check that Telegram for Android is updated to version 12.10.4 or later on company-managed and work-used devices.
• Review mobile patch processes: Make sure critical app updates are applied promptly, not only operating system updates.
• Map unofficial app usage: Identify whether employees use Telegram for customer, supplier or internal business communication, even if it is not formally approved.
• Assess BYOD exposure: Review whether personal Android devices used for work have adequate security controls, update requirements and separation from corporate data.
• Reinforce mobile threat awareness: Remind staff that voice calls inside messaging apps can also be part of an attack chain, not only links and file attachments.
• Prepare incident steps: If there is concern that vulnerable devices may have been exposed, security teams should review access tokens, messaging history, linked accounts and other sensitive business apps on affected phones.

For European businesses, the practical lesson is broader than Telegram itself: consumer messaging apps used in business workflows can introduce enterprise risk, especially on mobile devices. Even when a flaw is already patched, organisations should verify updates quickly and include third-party messaging apps in their security governance.