Safety researchers have found a vital vulnerability in Google’s Quick Pair protocol that may enable attackers to hijack Bluetooth audio equipment, observe customers, and snoop on their conversations.
The flaw (tracked as CVE-2025-36911 and dubbed WhisperPair) impacts a whole lot of hundreds of thousands of wi-fi headphones, earbuds, and audio system from a number of producers that help Google’s Quick Pair characteristic. It impacts customers no matter their smartphone working system as a result of the flaw lies within the equipment themselves, that means that iPhone customers with weak Bluetooth gadgets are equally in danger.
Researchers with KU Leuven’s Laptop Safety and Industrial Cryptography group who found it clarify that the vulnerability stems from the improper implementation of the Quick Pair protocol in lots of flagship audio equipment.
Though the Quick Pair specification says that Bluetooth gadgets ought to ignore pairing requests when not in pairing mode, many distributors haven’t enforced this test of their merchandise, permitting unauthorized gadgets to provoke pairing with out the consumer’s consent or data.
“To start out the Quick Pair process, a Seeker (a telephone) sends a message to the Supplier (an adjunct) indicating that it desires to pair. The Quick Pair specification states that if the accent is just not in pairing mode, it ought to disregard such messages,” the researchers stated.
“Nevertheless, many gadgets fail to implement this test in observe, permitting unauthorised gadgets to begin the pairing course of. After receiving a reply from the weak machine, an attacker can end the Quick Pair process by establishing a daily Bluetooth pairing.”
Attackers can exploit the WhisperPair flaw utilizing any Bluetooth-capable machine (reminiscent of a laptop computer, a Raspberry Pi, or perhaps a telephone) to forcibly pair with weak equipment from Google, Jabra, JBL, Logitech, Marshall, Nothing, OnePlus, Sony, Soundcore, and Xiaomi at ranges as much as 14 meters inside seconds and with out consumer interplay or bodily entry.
After pairing, they acquire full management over the audio machine, enabling them to blast audio at excessive volumes or snoop on customers’ conversations via the machine’s microphone.
CVE-2025-36911 additionally permits attackers to trace their victims’ location utilizing Google’s Discover Hub community if the accent has by no means been paired with an Android machine by including the machine to their very own Google account.
“The sufferer might even see an undesirable monitoring notification after a number of hours or days, however this notification will present their very own machine,” they added. “This will likely lead customers to dismiss the warning as a bug, enabling an attacker to maintain monitoring the sufferer for an prolonged interval.”
Google awarded the researchers $15,000, the utmost potential bounty, and labored with producers to launch safety patches throughout a 150-day disclosure window. Nevertheless, they famous that safety updates addressing this flaw might not but be out there for all weak gadgets.
The one protection towards attackers hijacking weak Quick Pair-enabled Bluetooth equipment is putting in firmware updates from machine producers. Disabling Quick Pair on Android telephones doesn’t forestall the assault, because the characteristic can’t be disabled on the equipment themselves.
Whether or not you are cleansing up previous keys or setting guardrails for AI-generated code, this information helps your crew construct securely from the beginning.
Get the cheat sheet and take the guesswork out of secrets and techniques administration.
