WhisperPair Attack Leaves Millions of Bluetooth Accessories Open to Hijacking

SecurityWeek reports a vulnerability in the Google Fast Pair implementation of Bluetooth audio accessories that can force connections to attacker‑controlled devices without user consent, tracked as CVE-2025-36911.

The flaw, caused by a logic error in the pairing code, allows attackers within about 14 metres to complete the Fast Pair procedure and take control of the accessory, potentially letting them play audio at high volumes or use the microphone to record conversations, according to the Computer Security and Industrial Cryptography group of Belgium’s KU Leuven University.

The researchers also warn that WhisperPair can be used to track users via Google’s Find Hub network, with attackers able to claim ownership of unpaired accessories by writing Account Keys to them.

Google, Jabra, JBL, Logitech, Marshall, Nothing, OnePlus, Sony, Soundcore and Xiaomi are named as impacted brands, with hundreds of millions of devices potentially affected; Google rolled out a Pixel security update this week, but the researchers emphasise that updates to Android phones alone are not enough and that firmware patches for accessories are also required. The discovery was reported after researchers notified Google in August 2025 and earned a $15,000 bug bounty.