WhisperPair: Fast Pair Headphones Vulnerable, Explained

• Key Takeaways:
• WhisperPair is a Fast Pair vulnerability that can let attackers hijack Bluetooth audio devices to play audio, track location, or access microphones.
• KU Leuven researchers say more than a dozen models from 10 manufacturers (including Google, Sony, Nothing, JBL, OnePlus) are affected.
• The median takeover time is about 10 seconds at ranges up to 14 meters; Google has notified partners and pushed some patches.
• Immediate mitigation: keep companion apps installed, update firmware when available, and factory reset suspect accessories.

What is WhisperPair?

WhisperPair is a newly disclosed vulnerability in devices that implement Google’s Fast Pair Bluetooth provisioning. Researchers at KU Leuven found that some accessories accept Fast Pair connection requests even when they are not in pairing mode.

Why that matters

Fast Pair is designed to simplify Bluetooth pairing between phones and accessories. If a device fails to enforce the requirement to accept Fast Pair only in pairing mode, an attacker can force a connection and then use normal Bluetooth controls to interfere with or surveil the device.

Who and which devices are affected?

The research team reports the bug impacts more than a dozen models across roughly 10 manufacturers. Named brands include Google (Pixel Buds Pro 2), Sony, Nothing, JBL, and OnePlus. The project maintains a full list of vulnerable models at the researchers’ site (whisperpair.eu).

How attackers exploit the flaw

KU Leuven’s tests show an attacker can seize a vulnerable Fast Pair device in a median of about 10 seconds and at distances up to 14 meters. Once connected, an attacker can interrupt audio, play arbitrary audio, obtain microphone access, and triangulate or track the device’s location.

Technical root cause

The issue stems from incomplete or incorrect implementation of the Fast Pair standard: devices are expected to validate pairing-mode state before accepting a Fast Pair request but many do not, allowing WhisperPair to hijack the connection via the standard Bluetooth pairing flow.

Mitigation, vendor response, and user advice

Google says it has notified partners and pushed updates for some Google-made accessories. KU Leuven reported that early vendor patches were bypassable in some cases, and full remediation may take weeks or months as accessory firmware updates roll out unevenly.

What users should do now

Install the official companion app for your accessory and apply firmware updates when available. If you suspect a compromise, factory reset the accessory to break existing pairings. Note that Fast Pair cannot be disabled on supported accessories, so firmware fixes from vendors are the long-term solution.

Google says it is unaware of active exploitation in the wild, but disclosure increases risk. Check the researchers’ site for an up-to-date vulnerable-device list and watch for vendor firmware advisories.