Vulnerability in Google's Fast Pair Enables Device Hijacking

Security researchers from Belgium's KU Leuven University have uncovered a critical vulnerability in Google's Fast Pair technology, allowing attackers to hijack Bluetooth audio devices such as headphones and speakers without the owner's knowledge. The flaw, tracked as CVE-2025-36911 and named WhisperPair, was reported to Google in August 2025, prompting firmware updates from multiple manufacturers to protect potentially hundreds of millions of affected devices worldwide.

Fast Pair is a Google feature designed to simplify Bluetooth connections for audio accessories with Android phones, tablets, and Chromebooks, enabling quick pairing with a single tap. However, the vulnerability stems from a logic error in the pairing process. According to the researchers from KU Leuven's Computer Security and Industrial Cryptography group, many devices fail to verify whether they are in pairing mode before accepting connection requests. This oversight lets an attacker, using any Bluetooth-capable device like a laptop, initiate and complete pairing within seconds from up to 14 meters away, even if the accessory is powered on and not actively seeking a connection.