Talos Vulnerability Report


Telegram Android Secret Chats Information Disclosure Vulnerability

December 21, 2018
CVE Number




Tested Versions

Telegram Messaging Application for Android 4.9.0

Product URLs


CVSSv3 Score

4.2 - CVSS:3.0/AV:L/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N


CWE-359: Exposure of Private Information ('Privacy Violation')


When a user takes a picture to send over a secret chat, a copy of that photo will remain on the Android filesystem even after the user deletes the chat, or even if the chat is self-destructed.

The problem lies in the way Telegram takes the photo upon user request. Looking at the source code, specifically at the file org/telegram/ui/ChatActivity.java, we see the following:

try {
Intent takePictureIntent = new Intent(MediaStore.ACTION_IMAGE_CAPTURE);
File image = AndroidUtilities.generatePicturePath();
    if (image != null) {
        if (Build.VERSION.SDK_INT >= 24) {
            takePictureIntent.putExtra(MediaStore.EXTRA_OUTPUT,             FileProvider.getUriForFile(getParentActivity(), BuildConfig.APPLICATION_ID + ".provider", image));
        } else {
            takePictureIntent.putExtra(MediaStore.EXTRA_OUTPUT, Uri.fromFile(image));
        currentPicturePath = image.getAbsolutePath();
    startActivityForResult(takePictureIntent, 0);

Telegram uses the MediaStore.ACTIONIMAGECAPTURE intent to take the picture. This means that the photo is actually taken by the application that is registered to act upon this action. Although Telegram Messenger passes the path to save the picture it doesn't control what that application does with the photo.

In most cases the native camera application will save the photo on the Android file system next to the picture that's saved on the system to the path passed by the Telegram Messenger.

This means that when a secret chat is deleted, Telegram Messenger deletes the photo which resides in the path it provided to Mediastore, but not the one saved by the native camera application.

In order to avoid this issue Telegram should implement its own photo taking code using the Camera2 class (the Camera class could also be used but it as been deprecated on API level 21). This way the application can ensure that the photo data is not saved by a third party application.


2018-08-31 - Vendor Disclosure
2018-12-21 - Public Release


Discovered by Vitor Ventura of Cisco Talos.