WhisperPair: Critical Fast Pair Flaw Exposes Headphones to Hijacking

WhisperPair is a flaw in Google Fast Pair uncovered by researchers from KU Leuven’s Computer Security and Industrial Cryptography group, exposing hundreds of millions of flagship audio devices to hijacking and tracking. The attack stems from a chain of compliance failures across implementation, validation and certification levels, allowing a pairing request to be forced by an attacker with commodity hardware within Bluetooth range and without user interaction.

Once paired, the attacker can control the accessory, blasting audio or potentially using the device’s microphone to eavesdrop on conversations. In certain scenarios, a compromised accessory could be added to the Find Hub Network with a malicious account, effectively turning the victim’s headphones into a tracking beacon. The researchers reported the issue to Google in August 2025; Google classified it as critical (CVE-2025-36911) and awarded the researchers a $15,000 bounty.

While Google has engaged partners during a 150-day disclosure window to push fixes, updates depend on individual manufacturers since the flaw lies in the accessory firmware, making universal remediation challenging, according to CVE Watchtower.