WhisperPair exposes Bluetooth earbuds and headphones to tracking and eavesdropping

WhisperPair is a set of attacks that lets an attacker hijack many popular Bluetooth audio accessories that use Google Fast Pair and, in some cases, even track their location via Google’s Find Hub network—all without requiring any user interaction. Researchers at the Belgian University of Leuven revealed vulnerabilities in audio accessories that use Google Fast Pair, affecting products sold by 10 companies including Sony, Jabra, JBL, Marshall, Xiaomi, Nothing, OnePlus, Soundcore, Logitech and Google itself.

The weakness lies in Fast Pair skipping checks for whether a device is in pairing mode, allowing a device controlled by an attacker to trigger Fast Pair and take full control after a quick pairing. This can enable actions from playing disturbing noises to recording audio via built‑in microphones, and if the attacker pairs first they can designate their Google account as the legitimate owner, potentially enabling Find Hub tracking.

The vulnerability is tracked as CVE-2025-36911 and is classified as critical; the only real fix is a firmware or software update from the accessory manufacturer, so users should check with their brand and install updates rather than relying on a phone update alone. The researchers tested 25 commercial devices from 16 manufacturers across 17 Bluetooth chipsets and were able to take over the connection and eavesdrop on the microphone on 68% of the devices examined.