Signal · Disclosed

Signal patched bug that kept microphone live after hang-up

Oct 28, 2026 · 1 min read

A critical Signal bug on Android let the other person on a call keep listening to your microphone, and possibly your camera, after you hung up. The attack flooded the call's event queue to stall the hang-up. Signal patched CVE-2026-113380 on Android in September, with no known attacks; update the app.

By HIFY Radar newsroom Updated 10/28/2026 08:51 PM Get this every day →← Back to the feed 1 source

HighVulnerabilityDisclosedPatched

In this article

What happened
Why it matters
What to do
For the technical team
Timeline
Sources

What happened

A Signal bug on Android let the other person on a call keep listening to your microphone, and possibly your camera, after you hung up. The attack flooded the call's event queue to stall the hang-up. Signal patched the bug on Android in September and no attacks are known.

Why it matters

Conversations could be captured without the user knowing, even after ending the call. The risk hits people who rely on Signal precisely for confidentiality, including teams handling sensitive data. No attacks are known, according to the report.

What to do

Update Signal for Android to the latest version on all devices, including corporate ones.

For the technical team

CVE: CVE-2026-113380
Affected: Signal (aplicativo de mensagens; cliente Android) · Signal for Android. Affected versions not stated in the source.
Exploitation: No attacks are known, according to the report by @IntCyberDigest. PoC existence not stated.
Fix: Patch released by Signal on Android in September, according to the report. Version number not stated.
Vector: Signal client for Android during an active call. The other party floods the call's event queue to stall the hang-up, leaving the microphone and possibly the camera live after the user hangs up.
More details: The flaw is tracked as CVE-2026-113380 and described as critical. Fixes for iOS or desktop are not mentioned in the source. Discoverer not stated.