Safety researchers have found a important vulnerability in Google’s Quick Pair protocol that may permit attackers to hijack Bluetooth audio equipment, monitor customers, and listen in on their conversations.
The flaw (tracked as CVE-2025-36911 and dubbed WhisperPair) impacts a whole bunch of thousands and thousands of wi-fi headphones, earbuds, and audio system from a number of producers that help Google’s Quick Pair characteristic. It impacts customers no matter their smartphone working system as a result of the flaw lies within the equipment themselves, that means that iPhone customers with susceptible Bluetooth gadgets are equally in danger.
Researchers with KU Leuven’s Laptop Safety and Industrial Cryptography group who found it clarify that the vulnerability stems from the improper implementation of the Quick Pair protocol in lots of flagship audio equipment.
Though the Quick Pair specification says that Bluetooth gadgets ought to ignore pairing requests when not in pairing mode, many distributors haven’t enforced this test of their merchandise, permitting unauthorized gadgets to provoke pairing with out the consumer’s consent or information.
“To start out the Quick Pair process, a Seeker (a cellphone) sends a message to the Supplier (an adjunct) indicating that it needs to pair. The Quick Pair specification states that if the accent will not be in pairing mode, it ought to disregard such messages,” the researchers mentioned.
“Nevertheless, many gadgets fail to implement this test in apply, permitting unauthorised gadgets to start out the pairing course of. After receiving a reply from the susceptible system, an attacker can end the Quick Pair process by establishing a daily Bluetooth pairing.”
Attackers can exploit the WhisperPair flaw utilizing any Bluetooth-capable system (equivalent to a laptop computer, a Raspberry Pi, or perhaps a cellphone) to forcibly pair with susceptible equipment from Google, Jabra, JBL, Logitech, Marshall, Nothing, OnePlus, Sony, Soundcore, and Xiaomi at ranges as much as 14 meters inside seconds and with out consumer interplay or bodily entry.
After pairing, they acquire full management over the audio system, enabling them to blast audio at excessive volumes or listen in on customers’ conversations by way of the system’s microphone.
CVE-2025-36911 additionally permits attackers to trace their victims’ location utilizing Google’s Discover Hub community if the accent has by no means been paired with an Android system by including the system to their very own Google account.
“The sufferer might even see an undesirable monitoring notification after a number of hours or days, however this notification will present their very own system,” they added. “This may increasingly lead customers to dismiss the warning as a bug, enabling an attacker to maintain monitoring the sufferer for an prolonged interval.”
Google awarded the researchers $15,000, the utmost potential bounty, and labored with producers to launch security patches throughout a 150-day disclosure window. Nevertheless, they famous that security updates addressing this flaw could not but be accessible for all susceptible gadgets.
The one protection in opposition to attackers hijacking susceptible Quick Pair-enabled Bluetooth equipment is putting in firmware updates from system producers. Disabling Quick Pair on Android telephones doesn’t stop the assault, because the characteristic can’t be disabled on the equipment themselves.
As MCP (Mannequin Context Protocol) turns into the usual for connecting LLMs to instruments and knowledge, security groups are shifting quick to maintain these new companies protected.
This free cheat sheet outlines 7 greatest practices you can begin utilizing right now.
