Sony, Anker, and different headphones have a critical Google Quick Pair safety vulnerability

A number of Bluetooth audio units from corporations like Sony, Anker, and Nothing are prone to a brand new flaw that may enable attackers to pay attention to conversations or observe units that use Google’s Discover Hub community, as reported by Wired.

Researchers from KU Leuven College’s Laptop Safety and Industrial Cryptography group in Belgium found a number of vulnerabilities in Google’s Quick Pair protocol that may enable a hacker inside Bluetooth vary to secretly pair with some headphones, earbuds, and audio system. The assaults, which the researchers have collectively dubbed WhisperPair, may even be used on iPhone customers with affected Bluetooth units regardless of Quick Pair being a Google-specific function.

Quick Pair streamlines Bluetooth pairing and lets wi-fi audio equipment connect with Android or Chrome OS units by merely tapping them collectively. However the researchers discovered that many units don’t implement Quick Pair appropriately, together with a Google specification that claims Quick Pair units shouldn’t have the ability to connect with a brand new gadget whereas already paired to a different.

The researchers examined their WhisperPair assaults on over two dozen Bluetooth units and have been profitable in hacking 17 of them. They have been capable of play their very own audio via the compromised headphones and audio system at any quantity, intercept telephone calls, and even snoop on conversations utilizing the units’ microphones.

A extra critical problem was discovered to have an effect on 5 Sony merchandise and Google’s Pixel Buds Professional 2. If the units weren’t beforehand related to an Android gadget and linked to a Google account (which isn’t required when utilizing them with iPhones), WhisperPair might be used to pair and hyperlink them to a hacker’s Google account that may be acknowledged because the gadget’s proprietor. That will enable a hacker to make use of Google’s Discover Hub community to trace the consumer’s location and actions via their headphones, assuming smartphone notifications warning {that a} gadget was monitoring them have been dismissed as errors.

The researchers reported their findings to Google in August 2025. The corporate then really useful fixes to its “accent OEM companions” in September and up to date its certification necessities to mitigate related points going ahead. “We labored with these researchers to repair these vulnerabilities, and we’ve not seen proof of any exploitation exterior of this report’s lab setting,” Google spokesperson Ed Fernandez says in a written assertion to The Verge.

The really useful fixes resolve all of the Quick Pair points as soon as a software program replace has been put in, however Google applied an extra Discover Hub community replace to stop WhisperPair from getting used to trace sure Bluetooth units that haven’t been patched. The researchers instructed Wired it solely took them a number of hours to bypass that patch and proceed their monitoring. In line with Fernandez, the researchers used “previous/not up to date accent OEM firmware as a way to execute their workaround,” and Google is “wanting into the bypass for this extra repair,” which was solely submitted earlier this week.

The Quick Pair function can’t be disabled, so the one solution to defend towards WhisperPair assaults is for customers to put in firmware updates launched by producers that resolve the vulnerabilities. The Verge reached out to all of the producers with affected {hardware} to verify the progress of fixes. Spenser Clean, the pinnacle of selling & communications for OnePlus North America, instructed The Verge in a written assertion that the corporate “takes all safety stories severely” and that it’s “presently investigating this matter and can take applicable motion to guard our customers’ safety and privateness.”

We’ll replace this story as different corporations reply.