“Headphone Jacking”: Critical Flaws in Popular Earbuds Let Hackers Hijack Your Phone

According to ERNW Enno Rey Netzwerke GmbH, a new white paper exposes three critical vulnerabilities in Airoha Bluetooth SoCs that power millions of True Wireless Earbuds from brands such as Sony, JBL, Marshall and Jabra, enabling attackers to eavesdrop on conversations and even hijack the connected phone.

The flaws centre on a proprietary diagnostic protocol called RACE, which was left unlocked on production devices and exposed over Bluetooth Classic and BLE, allowing unauthenticated access due to a lack of authentication. Researchers demonstrated that, once connected, the RACE protocol can read and write to memory and flash storage, read metadata about the currently playing media, and even hijack the microphone.

The vulnerabilities are tracked as CVE-2025-20700, CVE-2025-20701, and CVE-2025-20702, affecting models including Sony WH-1000XM5, WF-1000XM5 and LinkBuds S; JBL Live Buds 3 and Endurance Race 2; Marshall Major V and Acton III; and Beyerdynamic Amiron 300. Security experts urge users to apply firmware updates promptly, with some manufacturers releasing patches, while advising that many devices remain at risk due to market fragmentation.