WhisperPair Vulnerability: Google Fast Pair Security Flaw Enables 10-Second Remote Hijacking

Is your Bluetooth headset spying on you? A newly discovered vulnerability in Google Fast Pair can hijack your audio in just 10 seconds, leaving millions of users vulnerable to remote eavesdropping.

The WhisperPair Exploit: Google Fast Pair Under Fire

Security researchers from Belgium’s KU Leuven University have unveiled a critical flaw dubbed WhisperPair. This exploit allows an attacker to take control of Fast Pair-enabled devices without the owner ever noticing. According to the research, the hijacking process takes a median of only 10 seconds, making it a lightning-fast threat in public spaces.

The attack can be executed from a distance of up to 14 meters, which is nearly the limit of the Bluetooth protocol. This range is significant because it allows malicious actors to operate covertly, potentially listening to private conversations or injecting audio while remaining undetected by the victim.

A Security Gap in the Bluetooth Ecosystem

The scope of this vulnerability is massive. It affects more than a dozen devices from 10 manufacturers, including industry giants like Sony, Nothing, JBL, and OnePlus. Even users who don't own Google hardware could be at risk if their accessories support the Fast Pair standard.

While Google has officially acknowledged the flaw and notified its partners, the responsibility for fixing it lies with the individual hardware makers. They must develop and push out firmware patches for each specific model—a process that is historically slow for non-smartphone peripherals. Users are urged to check for firmware updates immediately via their device apps.