Loading story…
Security researchers from KU Leuven disclosed a critical weakness in Google’s Fast Pair Bluetooth pairing protocol implementation—tracked as CVE-2025-36911 and dubbed WhisperPair—that enables attackers to forcibly initiate pairing with vulnerable Bluetooth audio accessories even when they are not in pairing mode. Because the flaw is in the accessories’ Fast Pair behavior (not the phone OS), it can affect users across platforms, including iPhone users, and could be exploited using common Bluetooth-capable hardware (e.g., laptops, phones, or small single-board computers) to hijack connections, track users, and potentially eavesdrop via compromised headphones/earbuds/speakers from multiple vendors.
Reporting indicates the root cause is widespread failure to enforce a key Fast Pair requirement: accessories should ignore pairing requests unless explicitly in pairing mode, but many products respond anyway, allowing an attacker to complete a standard Bluetooth pairing without user awareness. The disclosures also raised questions about Google’s certification pipeline: devices tested by the researchers were reportedly Fast Pair certified, implying they passed Google’s Validator App checks and additional lab testing, yet still exhibited the vulnerable behavior; Google said it has since added new tests focused on these requirements. Responsibility remains unclear between device manufacturers and chipset suppliers; WIRED notes multiple chipset vendors were contacted without comment, while Xiaomi attributed the issue to a “non-standard configuration” by chip suppliers (with Airoha identified as the chipset maker in at least one vulnerable product cited by the researchers).
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
6 events from the most recent confirmed update back to the earliest known activity.
Researchers released WPair, an Android tool for detecting and demonstrating CVE-2025-36911 on Fast Pair devices. The app includes scanning, non-invasive patch-status testing, and an exploit demonstration for authorized security assessment.
On January 15, 2026, KU Leuven researchers publicly disclosed WhisperPair, describing how many Google Fast Pair audio accessories improperly accept pairing requests when not in pairing mode. They published technical details, impact scenarios including hijacking, eavesdropping, and Find Hub tracking, and a searchable list of affected devices.
Following the researchers' report, Google updated its Fast Pair Validator App and related certification testing with new implementation checks intended to catch the reported flaws. Researchers argued the broader architectural weakness still required stronger protocol-level protections.
During the coordinated disclosure period, multiple vendors began issuing software or firmware updates to address the specific WhisperPair implementation flaws in affected headphones, earbuds, and speakers. Patch availability varied by brand and model, and some devices remained unpatched.
After the private report, Google coordinated a roughly 150-day disclosure window with affected manufacturers so they could prepare firmware fixes for vulnerable Fast Pair audio accessories. The issue was treated as accessory-side, requiring vendor updates rather than phone-only mitigations.
Researchers from KU Leuven disclosed a family of Fast Pair implementation flaws to Google in August 2025. Google assigned CVE-2025-36911, rated the issue critical, and later awarded the team a $15,000 bug bounty.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
17 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcezdnet.com
Open sourcecybersecuritynews.com
Open sourcesecurityonline.info
Open sourcebleepingcomputer.com
Open sourcewired.com
Open sourcewhisperpair.eu
Open sourcemacworld.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers at KU Leuven disclosed **WhisperPair**, a set of Bluetooth attacks against flawed implementations of Google’s Fast Pair protocol in headphones, earbuds, and speakers from multiple vendors, including **Sony, Anker, Nothing**, and others. The vulnerabilities can allow an attacker within Bluetooth range to silently pair with a target device, play audio, intercept calls, and activate built-in microphones for eavesdropping. Reporting on the disclosure said the issue affects audio accessories that rely on Fast Pair and stems from vendor implementation weaknesses rather than confirmed abuse in the wild. In the most serious cases, affecting five Sony models and **Google Pixel Buds Pro 2**, researchers said an attacker could bind a device to their own Google account and misuse Google’s **Find Hub** network to track a victim’s location if the accessory had not already been linked to an Android device and Google account. Google said it coordinated with the researchers, issued remediation guidance to accessory makers in September 2025, and tightened certification requirements, while vendors reported patches released, under testing, or planned through OTA firmware updates. Researchers also said they quickly bypassed an added Find Hub mitigation, though Google said that bypass depended on outdated firmware and remains under investigation.
Jun 29, 2026
Researchers disclosed three vulnerabilities in Bluetooth audio devices built on Airoha systems-on-chip that can allow an attacker within radio range to gain unauthorized access to device memory and communications. The flaws, tracked as **`CVE-2025-20700`**, **`CVE-2025-20701`**, and **`CVE-2025-20702`**, stem from missing authentication in GATT and Bluetooth BR/EDR components and weak permission controls in a proprietary protocol, affecting headphones and earbuds sold by brands including **Sony, Bose, Jabra, JBL, Marshall, Beyerdynamic, and Teufel**. ERNW researchers said the bugs can be chained to hijack the Bluetooth link between a phone and an audio device, issue commands to the paired phone through the **Hands-Free Profile**, eavesdrop on conversations, and potentially overwrite firmware for remote code execution on the accessory. The attack requires proximity because exploitation is limited by Bluetooth range, but defenders were urged to apply vendor firmware updates and investigate or restart devices showing abnormal Bluetooth behavior.
Jul 24, 2026
Security researchers have identified and disclosed several critical vulnerabilities in Bluetooth headphones and earbuds powered by Airoha Bluetooth System-on-Chips (SoCs), which are widely used by major brands such as Sony, Bose, JBL, Marshall, and Jabra. The vulnerabilities, tracked as CVE-2025-20700, CVE-2025-20701, and CVE-2025-20702, allow attackers within Bluetooth range to eavesdrop on conversations, steal sensitive data, and potentially hijack connected smartphones. The most severe flaw, related to the RACE (Remote Access Control Engine) protocol, enables remote code execution and arbitrary memory access due to missing authentication mechanisms in both Bluetooth Low Energy and Classic modes. Despite initial disclosure in June 2025 and the availability of patches, many affected devices remain unpatched, increasing the risk of exploitation. The RACE protocol, originally designed for factory debugging and firmware updates, is exposed over multiple interfaces, including Bluetooth and USB HID, providing attackers with powerful capabilities if exploited. Researchers have released a white paper and the RACE Toolkit to help users and security professionals assess device vulnerability. The ongoing exposure of these flaws highlights the importance of timely patching and the risks associated with insecure default configurations in widely deployed consumer electronics. Users of affected headphones and earbuds are urged to check for firmware updates and apply patches as soon as possible to mitigate the risk of compromise.
Jun 29, 2026