Safety researchers have found a crucial vulnerability in Google’s Quick Pair protocol that may permit attackers to hijack Bluetooth audio equipment, observe customers, and snoop on their conversations.
The flaw (tracked as CVE-2025-36911 and dubbed WhisperPair) impacts a whole bunch of hundreds of thousands of wi-fi headphones, earbuds, and audio system from a number of producers that help Google’s Quick Pair characteristic. It impacts customers no matter their smartphone working system as a result of the flaw lies within the equipment themselves, that means that iPhone customers with susceptible Bluetooth gadgets are equally in danger.
Researchers with KU Leuven’s Laptop Safety and Industrial Cryptography group who found it clarify that the vulnerability stems from the improper implementation of the Quick Pair protocol in lots of flagship audio equipment.
Though the Quick Pair specification says that Bluetooth gadgets ought to ignore pairing requests when not in pairing mode, many distributors haven’t enforced this test of their merchandise, permitting unauthorized gadgets to provoke pairing with out the consumer’s consent or data.
“To begin the Quick Pair process, a Seeker (a telephone) sends a message to the Supplier (an adjunct) indicating that it desires to pair. The Quick Pair specification states that if the accent will not be in pairing mode, it ought to disregard such messages,” the researchers mentioned.
“Nonetheless, many gadgets fail to implement this test in observe, permitting unauthorised gadgets to begin the pairing course of. After receiving a reply from the susceptible gadget, an attacker can end the Quick Pair process by establishing an everyday Bluetooth pairing.”
Attackers can exploit the WhisperPair flaw utilizing any Bluetooth-capable gadget (similar to a laptop computer, a Raspberry Pi, or perhaps a telephone) to forcibly pair with susceptible equipment from Google, Jabra, JBL, Logitech, Marshall, Nothing, OnePlus, Sony, Soundcore, and Xiaomi at ranges as much as 14 meters inside seconds and with out consumer interplay or bodily entry.
After pairing, they acquire full management over the audio gadget, enabling them to blast audio at excessive volumes or snoop on customers’ conversations by means of the gadget’s microphone.
CVE-2025-36911 additionally permits attackers to trace their victims’ location utilizing Google’s Discover Hub community if the accent has by no means been paired with an Android gadget by including the gadget to their very own Google account.
“The sufferer may even see an undesirable monitoring notification after a number of hours or days, however this notification will present their very own gadget,” they added. “This will likely lead customers to dismiss the warning as a bug, enabling an attacker to maintain monitoring the sufferer for an prolonged interval.”
Google awarded the researchers $15,000, the utmost doable bounty, and labored with producers to launch safety patches throughout a 150-day disclosure window. Nonetheless, they famous that safety updates addressing this flaw could not but be out there for all susceptible gadgets.
The one protection in opposition to attackers hijacking susceptible Quick Pair-enabled Bluetooth equipment is putting in firmware updates from gadget producers. Disabling Quick Pair on Android telephones doesn’t forestall the assault, because the characteristic can’t be disabled on the equipment themselves.
Whether or not you are cleansing up previous keys or setting guardrails for AI-generated code, this information helps your group construct securely from the beginning.
Get the cheat sheet and take the guesswork out of secrets and techniques administration.
