New ‘AirSnitch’ Attack Shows Wi-Fi Client Isolation Could Be a False Sense of Security

Researchers have uncovered a Wi-Fi vulnerability that allows nearby attackers to intercept sensitive data and execute machine-in-the-middle attacks against connected devices.

Researchers from UC Riverside developed attacks able to bypass client isolation in Wi-Fi networks used at home, at work, in airports, and in coffee shops.

Four computer scientists from Riverside, and one from KU Leuven (Belgium) found that every router and network they tested was vulnerable to at least one attack. Their findings are detailed in a paper (AirSnitch: Demystifying and Breaking Client Isolation in Wi-Fi Networks) presented at the NDSS Symposium 2026.

Wi-Fi client isolation, also known as Access Point (AP) isolation or station isolation, is the security feature that ensures Wi-Fi clients cannot intercept, transmit, or inject traffic from or to other clients within the same wireless local area network.

If client isolation is active, the primary role of the AP device in switching traffic from source ...