Critical vulnerability found in Signal: microphone and camera could remain active after call ended

Technical error details

Cybersecurity experts identified a critical vulnerability in the popular messenger Signal. This bug posed a risk of unauthorised access to audio and images from users' cameras. According to expert assessments, the severity level of this flaw was 9.3 out of a maximum possible 10, indicating its high criticality.

Exploitation mechanism

As noted, the issue was triggered in a situation where a counterpart intentionally performed an action that caused the application to crash. Such a manipulative process could prevent the command responsible for ending the call from functioning correctly. As a result, the microphone and camera continued transmitting data even after the formal end of the conversation, allowing eavesdropping and image capture.

Fix timeline

The Signal development team has already resolved this vulnerability. The fix was implemented in September 2026. However, the public disclosure of incident details occurred later — on 20 October. To date, no confirmed cases have been recorded where this error was used for actual surveillance of users.

Recommendations for users

To ensure the full security of their data, experts advise updating the Signal messenger to the latest available version, which contains the relevant security patches, as soon as possible.