At a Glance
- A Fast Pair bug in hundreds of millions of Bluetooth devices lets attackers pair without user consent.
- Attackers can hijack microphones, track location via Google’s Find Hub, and stay hidden for days.
- Sony, JBL, Xiaomi, Nothing, OnePlus, Jabra, and Google models are affected.
Why it matters: Your headphones could spy on you or reveal your location even if you’ve never used an Android phone.
A design flaw in Google’s Fast Pair protocol has left hundreds of millions of wireless headphones, earbuds, and speakers open to takeover, researchers at Belgium’s KU Leuven University revealed. The weakness, dubbed “WhisperPair,” allows an attacker within 14 meters to seize control of a device, switch on its microphone, and track its owner through Google’s crowdsourced Find Hub network.
Fast Pair was built to let users connect Bluetooth accessories with a single tap. Many manufacturers failed to enforce a basic rule: ignore pairing requests when the device is not in pairing mode. Because that check is missing, unauthorized phones can start and finish pairing as if they were legitimate.
How WhisperPair works
- The attacker sends a Fast Pair request to the target device.
- The device skips the pairing-mode verification and accepts the request.
- Once paired, the attacker can inject commands, record audio, or add the device to Find Hub.
- The victim receives no alert during the attack; unwanted-tracking warnings may appear hours later, listing the victim’s own phone as the tracker, leading many users to dismiss the alert as a glitch.
Tracking through Find Hub
Google’s Find Hub network relies on Android phones worldwide to report the location of lost accessories. An attacker who compromises a device can register it to their own Google account. Even iPhone owners remain at risk because the attacker can add the accessory to Find Hub without ever touching the victim’s phone.
Sony and Google headphones are explicitly vulnerable to the Find Hub location scheme. Other brands affected by the core Fast Pair flaw include JBL, Xiaomi, Nothing, OnePlus, and Jabra.
Fixes and next steps
Google told News Of Fort Worth it has already patched Pixel Buds and updated certification requirements for manufacturers. Developers distributed fixes for the Find Hub issue and shared recommended code changes with every affected vendor.
“We appreciate collaborating with security researchers through our Vulnerability Rewards Program, which helps keep our users safe,” a Google spokesperson told News Of Fort Worth. “We worked with these researchers to fix these vulnerabilities, and we have not seen evidence of any exploitation outside of this report’s lab setting.”
Users must install firmware updates through each manufacturer’s companion app. Sony WH-1000XM6 owners, for example, should open the Sony app and accept any pending update.
“As a best security practice, we recommend users check their headphones for the latest firmware updates. We are constantly evaluating and enhancing Fast Pair and Find Hub security,” the spokesperson added.
Wired caution
Distrust of wireless audio security is not new. During a late-night interview last year, former Vice President Kamala Harris told Stephen Colbert she refuses to use earbuds on trains. “I have been in classified briefings, and I’m telling you, don’t be on the train using your earpods thinking someone can’t listen to your conversation,” she said. “I’m telling you, the [wired earphones] are a bit more secure.”
Key takeaways
- Check your manufacturer app today for firmware updates.
- If your phone shows an unexpected tracking alert, treat it as real until proven otherwise.
- Until patches arrive, consider turning Bluetooth off in crowded public spaces if your device is not in use.
