WhisperPair Attack Leaves Millions of Audio Accessories Open to Hijacking

A vulnerability in the Google Fast Pair implementation of Bluetooth audio accessories can be exploited to force connections to attacker-controlled devices, academic researchers warn.

The critical-severity issue is tracked as CVE-2025-36911 and exists due to a logic error in the key-based pairing code, where devices fail to check if they are in pairing mode.

Google Fast Pair enables fast pairing and account synchronization with Bluetooth accessories such as earbuds, headphones, and speakers, all with a single tap.

The Fast Pair specification states that the pairing procedure should only be performed if the accessory is in pairing mode, but models from numerous brands do not check the pairing status of the device.

These improper implementations of Fast Pair open the door to a series of attacks dubbed WhisperPair, which allow attackers to take control of vulnerable accessories, academic researchers at the Computer Security and Industrial Cryptography group of Belgium’s KU ...