Safety researchers have found a vital vulnerability in Google’s Quick Pair protocol that may permit attackers to hijack Bluetooth audio equipment, monitor customers, and snoop on their conversations.
The flaw (tracked as CVE-2025-36911 and dubbed WhisperPair) impacts a whole lot of hundreds of thousands of wi-fi headphones, earbuds, and audio system from a number of producers that assist Google’s Quick Pair function. It impacts customers no matter their smartphone working system as a result of the flaw lies within the equipment themselves, which means that iPhone customers with susceptible Bluetooth units are equally in danger.
Researchers with KU Leuven’s Pc Safety and Industrial Cryptography group who found it clarify that the vulnerability stems from the improper implementation of the Quick Pair protocol in lots of flagship audio equipment.
Though the Quick Pair specification says that Bluetooth units ought to ignore pairing requests when not in pairing mode, many distributors haven’t enforced this verify of their merchandise, permitting unauthorized units to provoke pairing with out the consumer’s consent or data.
“To start out the Quick Pair process, a Seeker (a telephone) sends a message to the Supplier (an adjunct) indicating that it desires to pair. The Quick Pair specification states that if the accent isn’t in pairing mode, it ought to disregard such messages,” the researchers stated.
“Nonetheless, many units fail to implement this verify in apply, permitting unauthorised units to start out the pairing course of. After receiving a reply from the susceptible system, an attacker can end the Quick Pair process by establishing a daily Bluetooth pairing.”
Attackers can exploit the WhisperPair flaw utilizing any Bluetooth-capable system (reminiscent of a laptop computer, a Raspberry Pi, or perhaps a telephone) to forcibly pair with susceptible equipment from Google, Jabra, JBL, Logitech, Marshall, Nothing, OnePlus, Sony, Soundcore, and Xiaomi at ranges as much as 14 meters inside seconds and with out consumer interplay or bodily entry.
After pairing, they achieve full management over the audio system, enabling them to blast audio at excessive volumes or snoop on customers’ conversations by way of the system’s microphone.
CVE-2025-36911 additionally permits attackers to trace their victims’ location utilizing Google’s Discover Hub community if the accent has by no means been paired with an Android system by including the system to their very own Google account.
“The sufferer may even see an undesirable monitoring notification after a number of hours or days, however this notification will present their very own system,” they added. “This will lead customers to dismiss the warning as a bug, enabling an attacker to maintain monitoring the sufferer for an prolonged interval.”
Google awarded the researchers $15,000, the utmost attainable bounty, and labored with producers to launch safety patches throughout a 150-day disclosure window. Nonetheless, they famous that safety updates addressing this flaw might not but be accessible for all susceptible units.
The one protection in opposition to attackers hijacking susceptible Quick Pair-enabled Bluetooth equipment is putting in firmware updates from system producers. Disabling Quick Pair on Android telephones doesn’t forestall the assault, because the function can’t be disabled on the equipment themselves.
It is funds season! Over 300 CISOs and safety leaders have shared how they’re planning, spending, and prioritizing for the 12 months forward. This report compiles their insights, permitting readers to benchmark methods, determine rising developments, and evaluate their priorities as they head into 2026.
Learn the way prime leaders are turning funding into measurable influence.
