CVE-2025-36911, also known by researchers as WhisperPair, is a serious security vulnerability affecting Bluetooth devices that implement Google’s Fast Pair protocol. Fast Pair is widely used by modern Bluetooth accessories such as wireless earbuds, headphones, speakers, and similar audio devices to simplify the pairing process with smartphones, tablets, and computers.
At its core, this vulnerability stems from a logic flaw in Bluetooth key-based pairing. Certain devices fail to properly verify whether they are genuinely in pairing mode before accepting pairing requests. As a result, an attacker within Bluetooth range can abuse the protocol to pair with a device without the owner’s awareness or consent.
Because Fast Pair is implemented across products from many manufacturers, this is not a single-vendor issue. Instead, it represents a systemic weakness affecting millions of Bluetooth audio accessories worldwide.
What Is WhisperPair?
WhisperPair is the name given by security researchers to describe a class of attacks enabled by CVE-2025-36911. The vulnerability allows unauthorized devices to initiate and complete a Bluetooth pairing process even when the target accessory is not actively in pairing mode.
Normally, Bluetooth devices are expected to be discoverable or explicitly placed into pairing mode before accepting new connections. However, in affected Fast Pair implementations, that safeguard can be bypassed. The attacker only needs to be physically nearby, typically within standard Bluetooth range.
The flaw was discovered and analyzed by academic researchers from KU Leuven (COSIC research group) and responsibly disclosed to Google before public release.
Severity and CVSS Assessment
From a risk perspective, CVE-2025-36911 is considered high severity.
Key severity metrics include:
- CVSS v3.1 Score: ~7.1 / 10
- Attack Vector: Adjacent (Bluetooth range required)
- Privileges Required: None
- User Interaction: None
- Primary Impact: Confidentiality and privacy
The high score reflects how easily the vulnerability can be exploited and the sensitive nature of the data exposed. Although the attacker must be nearby, no special permissions, credentials, or user actions are required, making the attack practical in many real-world environments.
How the Attack Works
The WhisperPair attack abuses weaknesses in the Fast Pair handshake process. When a vulnerable device receives a crafted pairing request, it may respond as if it were intentionally open for pairing. This can occur even if the owner has never put the device into pairing mode.
Once pairing is completed, the attacker effectively gains the same access level as a legitimate paired device. From that point forward, several attack scenarios become possible.
Potential Impact and Real-World Risks
1. Unauthorized Pairing
An attacker can silently pair with a victim’s Bluetooth accessory. This happens without any notification on the accessory itself and, in some cases, without a clear alert on the user’s phone or computer.
2. Audio Eavesdropping
One of the most serious consequences is unauthorized access to audio streams. If the accessory includes a microphone, the attacker may be able to:
- Listen to phone calls
- Capture ambient conversations
- Monitor voice assistant interactions
This creates obvious privacy risks, especially in workplaces, public spaces, or sensitive environments.
3. Device Control and Harassment
Once paired, attackers may also gain control over certain device functions, such as:
- Playing audio at maximum volume
- Interrupting legitimate audio playback
- Manipulating basic device settings
While this may seem minor compared to eavesdropping, it can still be disruptive or used as a form of harassment.
4. Location Tracking via Google’s Ecosystem
A particularly concerning scenario involves tracking. If a vulnerable Bluetooth accessory has never been paired with its legitimate owner, an attacker may be able to register it to their own Google account. This can enable tracking through Google’s Find Hub / Find My Device infrastructure.
In such cases, the attacker could monitor the approximate location of the accessory—and by extension, the person carrying it—without their knowledge.
Why So Many Devices Are Affected
The scope of WhisperPair is large because the vulnerability lies in protocol logic and firmware behavior, not in a single brand or model. Many manufacturers rely on Google’s Fast Pair reference designs or SDKs, sometimes with minimal customization.
If those implementations fail to strictly enforce pairing-mode checks, the resulting devices inherit the vulnerability. This explains why products from multiple major audio brands may be impacted simultaneously.
Devices affected
- Anker soundcore Liberty 4 NC
- Google Pixel Buds Pro 2
- JBL TUNE BEAM
- Jabra Elite 8 Active
- Marshall MOTIF II A.N.C.
- Nothing Ear (a)
- OnePlus Nord Buds 3 Pro
- Sony WF-1000XM5
- Sony WH-1000XM4
- Sony WH-1000XM5
- Sony WH-1000XM6
- Sony WH-CH720N
- Xiaomi Redmi Buds 5 Pro
Exploitation Requirements
From an attacker’s perspective, WhisperPair is relatively easy to exploit:
- No elevated privileges are required
- No user interaction is needed
- Standard hardware such as a smartphone, laptop, or inexpensive Bluetooth Low Energy (BLE) adapter is sufficient
- The only limitation is physical proximity, typically within 10 to 14 meters
This low barrier to entry significantly increases the real-world risk.
Mitigation and Defensive Measures
Firmware Updates (Most Important)
The most effective mitigation is updating the accessory’s firmware. In many cases, updating only the phone or operating system is not enough. The Bluetooth accessory itself must receive a patched firmware version from the manufacturer.
Users should regularly check companion apps or vendor support pages for firmware updates.
Vendor Security Advisories
Because patch timelines vary by manufacturer, monitoring official security advisories is essential. Some vendors have already released fixes, while others are still in the process of developing and distributing updates.
Temporary Workarounds
Until patches are applied, users can reduce risk by:
- Turning off Bluetooth when not actively in use
- Avoiding use of Bluetooth accessories in sensitive locations
- Ensuring new devices are paired immediately after purchase, reducing the risk of malicious first-pair registration
These steps are not foolproof but can lower exposure.
Disclosure Timeline and Current Status
- August 2025: Vulnerability responsibly disclosed to Google by academic researchers
- January 2026: Official CVE entry (CVE-2025-36911) published
- Present: Patch deployment ongoing; many devices remain unpatched
While awareness of WhisperPair has increased, remediation across the Bluetooth ecosystem will take time due to the sheer number of affected products and vendors.
CVE-2025-36911 highlights a growing concern in modern wireless ecosystems: convenience-driven protocols can introduce subtle but dangerous security flaws. Fast Pair dramatically improves user experience, but WhisperPair shows how insufficient validation can undermine privacy and trust at scale.
For users, the key takeaway is simple: keep Bluetooth accessories updated and stay informed. For manufacturers, WhisperPair serves as a reminder that security checks—even those that seem minor—must be rigorously enforced at every layer of device firmware.
