Telegram fixes Android flaw that turned a message into code execution

Telegram has fixed a flaw in its Android app that security firm V12 says let a message run code on the recipient's device. On 11 November at 11:00 UTC V12 posted a video demonstration with the line "Any telegram message can now become RCE", remote code execution, and a SHA-256 hash in place of technical details. Two hours later Telegram replied that the issue "in Telegram for Android was fixed yesterday, and the fix was deployed to all users earlier today."

A day after a new message feature

V12's post quotes Telegram founder Pavel Durov's announcement from 13:37 UTC on 10 November that "any Telegram message can now become an app": interactive, natively rendered mini apps under 4 KB that download instantly with a message and have payments built in. The wording of V12's post mirrors that launch, and the demonstration came about 21 hours after it. Neither V12 nor Telegram has said whether the flaw is in the new message apps or elsewhere in the Android client.

Publishing a hash is a common way for researchers to prove later that they held the details at a given time without revealing them before users have updated. Telegram's reply confirms that the issue was real and limited its statement to Android; it did not say whether the iOS, desktop or web clients were checked or affected.

Who V12 is

V12 describes itself as an autonomous AI hacker. In the past week it has also published an unauthenticated admin API flaw in Hugging Face Chat, found by a researcher using its tool, and posted a VirtualBox escape, again as a hash and a video.

What to do

Telegram says the fixed Android version has reached all users, so updating the app from the official store is the step to take. Telegram has not published a version number, a CVE or an advisory, and has not said whether the flaw was exploited before the fix.