Physical Address
304 North Cardinal St.
Dorchester Center, MA 02124
Several Bluetooth audio devices from companies like Sony, Anker, and Nothing are vulnerable to a new flaw that could allow attackers to listen in on conversations or track devices using Google’s Find Hub network. I mentioned before Wired.
Researchers from the Computer Security and Industrial Cryptography group at KU Leuven in Belgium have discovered several vulnerabilities in Google’s Fast Pair protocol that could allow a hacker within Bluetooth range to secretly pair with some headphones, earbuds and speakers. The attacks, which researchers called mass WhisperPairit can even be used on iPhone users with affected Bluetooth devices despite Fast Pair being a Google-specific feature.
Fast Pair simplifies the Bluetooth pairing process and allows wireless audio accessories to connect to Android or Chrome OS devices by simply tapping them together. But the researchers found that many devices don’t implement Fast Pair properly, including Google’s specification that states that Fast Pair devices shouldn’t be able to connect to a new device while they’re already paired with another device.
Researchers tested WhisperPair attacks on more than two dozen Bluetooth devices and successfully compromised 17 of them. They were able to play their own audio through hacked headphones and speakers at any volume, intercept phone calls, and even eavesdrop on conversations using the devices’ microphones.
A more serious issue has been found affecting five Sony products and Google’s Pixel Buds Pro 2. If the devices are not previously connected to an Android device and linked to a Google account (which is not required when used with iPhones), WhisperPair can be used to pair and link them to the hacker’s Google account, which will be identified as the owner of the device. This would allow a hacker to use Google’s Find Hub network to track a user’s location and movements through headphones, assuming smartphone notifications warning that the device was tracking them were dismissed as errors.
The researchers reported their findings to Google in August 2025. The company then recommended fixes for “accessory OEM partners” in September and updated its certification requirements to mitigate similar issues in the future. “We worked with these researchers to fix these vulnerabilities, and we have seen no evidence of any exploitation outside the laboratory setting of this report,” Ed Fernandez, a Google spokesman, said in a written statement. Edge.
The recommended fixes resolve all Fast Pair issues once the software update is installed, but Google has implemented an additional update to the Find Hub network to prevent WhisperPair from being used to track some unpatched Bluetooth devices. The researchers said Wired It only took a few hours to get past this correction and continue tracking. According to Fernandez, researchers used “outdated/outdated firmware for OEM accessories in order to implement the workaround,” and Google is “looking into overriding this additional fix,” which was only introduced earlier this week.
The Fast Pair feature cannot be disabled, so the only way to protect against WhisperPair attacks is for users to install manufacturer-issued firmware updates that resolve the vulnerabilities. Edge We have reached out to all manufacturers with affected devices to confirm the progress of the fixes. said Spencer Blank, Head of Marketing and Communications at OnePlus North America Edge In a written statement that the company “takes all security reports seriously” and that it is “currently investigating this matter and will take appropriate action to protect the security and privacy of our users.”
We will update this story as other companies respond.