Signal Messenger Bug Lets Callers Auto-Connect Calls Without Receivers’ Interaction

Almost every application contains security vulnerabilities, some of which you may find today, but others would remain invisible until someone else finds and exploits them—which is the harsh reality of cybersecurity and its current state.

And when we say this, Signal Private Messenger—promoted as one of the most secure messengers in the world—isn’t any exception.

Google Project Zero researcher Natalie Silvanovich discovered a logical vulnerability in the Signal messaging app for Android that could allow malicious caller to force a call to be answered at the receiver’s end without requiring his/her interaction.

In other words, the flaw could be exploited to turn on the microphone of a targeted Signal user’s device and listen to all surrounding conversations.

However, the Signal vulnerability can only be exploited if the receiver fails to answer an audio call over Signal, eventually forcing the incoming call to be automatically answered on the receiver’s device.

“In the Android client, there is a method handleCallConnected that causes the call to finish connecting. During normal use, it is called in two situations: when the callee device accepts the call when the user…