Safety researchers have found a crucial vulnerability in Google’s Quick Pair protocol that may enable attackers to hijack Bluetooth audio equipment, observe customers, and snoop on their conversations.
The flaw (tracked as CVE-2025-36911 and dubbed WhisperPair) impacts a whole bunch of hundreds of thousands of wi-fi headphones, earbuds, and audio system from a number of producers that help Google’s Quick Pair function. It impacts customers no matter their smartphone working system as a result of the flaw lies within the equipment themselves, that means that iPhone customers with weak Bluetooth units are equally in danger.
Researchers with KU Leuven’s Laptop Safety and Industrial Cryptography group who found it clarify that the vulnerability stems from the improper implementation of the Quick Pair protocol in lots of flagship audio equipment.
Though the Quick Pair specification says that Bluetooth units ought to ignore pairing requests when not in pairing mode, many distributors haven’t enforced this verify of their merchandise, permitting unauthorized units to provoke pairing with out the consumer’s consent or information.
“To start out the Quick Pair process, a Seeker (a telephone) sends a message to the Supplier (an adjunct) indicating that it desires to pair. The Quick Pair specification states that if the accent is just not in pairing mode, it ought to disregard such messages,” the researchers stated.
“Nonetheless, many units fail to implement this verify in follow, permitting unauthorised units to start out the pairing course of. After receiving a reply from the weak gadget, an attacker can end the Quick Pair process by establishing a daily Bluetooth pairing.”
Attackers can exploit the WhisperPair flaw utilizing any Bluetooth-capable gadget (resembling a laptop computer, a Raspberry Pi, or perhaps a telephone) to forcibly pair with weak equipment from Google, Jabra, JBL, Logitech, Marshall, Nothing, OnePlus, Sony, Soundcore, and Xiaomi at ranges as much as 14 meters inside seconds and with out consumer interplay or bodily entry.
After pairing, they acquire full management over the audio gadget, enabling them to blast audio at excessive volumes or snoop on customers’ conversations by the gadget’s microphone.
CVE-2025-36911 additionally permits attackers to trace their victims’ location utilizing Google’s Discover Hub community if the accent has by no means been paired with an Android gadget by including the gadget to their very own Google account.
“The sufferer might even see an undesirable monitoring notification after a number of hours or days, however this notification will present their very own gadget,” they added. “This will lead customers to dismiss the warning as a bug, enabling an attacker to maintain monitoring the sufferer for an prolonged interval.”
Google awarded the researchers $15,000, the utmost doable bounty, and labored with producers to launch safety patches throughout a 150-day disclosure window. Nonetheless, they famous that safety updates addressing this flaw might not but be obtainable for all weak units.
The one protection in opposition to attackers hijacking weak Quick Pair-enabled Bluetooth equipment is putting in firmware updates from gadget producers. Disabling Quick Pair on Android telephones doesn’t stop the assault, because the function can’t be disabled on the equipment themselves.
It is finances season! Over 300 CISOs and safety leaders have shared how they’re planning, spending, and prioritizing for the yr forward. This report compiles their insights, permitting readers to benchmark methods, establish rising developments, and evaluate their priorities as they head into 2026.
Find out how high leaders are turning funding into measurable affect.
