PT-2026-3081 · Google · Google Fast Pair

Published

2026-01-15

·

Updated

2026-06-01

·

CVE-2025-36911

CVSS v3.1

7.1

High

VectorAV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Name of the Vulnerable Software and Affected Versions Google Fast Pair (affected versions not specified)
Description A critical flaw exists in Google’s Fast Pair protocol, identified as WhisperPair (CVE-2025-36911). This flaw allows nearby attackers to silently hijack vulnerable Bluetooth headphones, earbuds, and speakers. The vulnerability stems from a logic error in key-based pairing, where devices accept pairing requests even when not in pairing mode. This enables attackers to re-pair with devices, potentially eavesdrop on conversations via the microphone, and track victims through Google Find Hub. The risk affects hundreds of millions of devices across many brands. Exploitation requires proximity (up to 14 meters) and can occur within approximately 10 seconds without user interaction. The vulnerability allows for unauthorized pairing and potential access to microphone functionality without the user's knowledge or consent. A tool called WPair has been developed to scan for and demonstrate the vulnerability.
Recommendations Apply firmware updates to your Bluetooth audio devices via companion apps.

Exploit

Fix

Weakness Enumeration

CWE-320

Related Identifiers

BDU:2026-00509
CVE-2025-36911

Affected Products

Google Fast Pair