The Telegram Android app's manifest includes android:allowBackup="true", enabling Android's backup system to include the app's data in device backups. This data includes saved authentication tokens and user preferences managed by a BackupAgentHelper subclass. An attacker with physical or adb access to the device could extract these backups using adb backup or bmgr backupnow commands. Extracted tokens allow session hijacking on other devices without requiring email or SMS verification if two-factor authentication is not enabled. The app stores PINs as salted SHA-256 hashes, which could be brute-forced offline using the extracted data. The configuration was changed from true to false in 2014 but was modified again on February 3, 2023, to re-enable backups. This potentially exposes user data to unauthorized access via adb backup mechanisms.

If an attacker gains adb or physical access to an affected device, they can extract Telegram app data backups containing authentication tokens and user preferences. This enables session hijacking without needing traditional login credentials or two-factor authentication, assuming 2FA is not enabled. Additionally, attackers can attempt offline brute-force attacks on the user's PIN using the extracted salted hashes. This compromises user account confidentiality and could lead to unauthorized access to Telegram chats and sessions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Users should verify if their Telegram app version disables android:allowBackup or if an update addresses this issue. Enabling two-factor authentication on Telegram accounts mitigates session hijacking risk even if tokens are extracted. Avoid granting adb access to untrusted parties and consider disabling USB debugging when not in use. Monitor official Telegram channels for updates or patches addressing this backup exposure.