Key Highlights:

• WhisperPair lets attackers hijack Fast Pair devices in seconds.
• More than 12 devices from Sony, JBL, Nothing, OnePlus, and Google are affected.
• Hackers can track location and access microphones remotely.
• Fixes depend on accessory makers, not Google alone.

Bluetooth pairing is meant to be simple. With Google Fast Pair, it is often instant. Now, security researchers warn that the same convenience enables silent hijacking.

A flaw called WhisperPair allows attackers to take over Fast Pair-enabled headphones and earbuds. The bug affects devices from major brands, including Sony, JBL, Nothing, OnePlus, and Google. Researchers from Belgium’s KU Leuven University revealed that an attacker can seize control in about 10 seconds.

The risk matters because attackers can track users and access microphones without being nearby.

What is WhisperPair and how does it work?

WhisperPair exploits an incomplete Fast Pair implementation. Devices should accept Fast Pair requests only in pairing mode. Many do not follow this rule. Instead, they accept connections at any time.

Attackers use the standard Bluetooth pairing process to force a connection. The hack works from up to 14 meters away. That distance is near Bluetooth’s limit. Victims would not notice anyone nearby.

Once connected, an attacker can interrupt audio or play sounds. More seriously, they can track the device’s location and access its microphone. That enables silent eavesdropping and movement tracking.

Which devices are affected?

The flaw impacts more than a dozen models across ten manufacturers. The list includes popular brands such as Sony, Nothing, JBL, OnePlus, and Google.

Google has acknowledged the issue and informed partners. However, each manufacturer must issue its own firmware fix. A full device list is available on the researchers’ project site.

Even users who never used Google products may be affected. Fast Pair support exists across Android ecosystems and accessories.

Why is fixing accessories harder?

Phones receive automatic security updates. Accessories often do not.

Many users never install companion apps. As a result, firmware stays outdated for years. WhisperPair is harder because users cannot disable Fast Pair. The only option is installing the official app and waiting for an update.

Google says it patched its own devices. Researchers told Wired they bypassed that fix. Widespread protection may take months.

What can users do now?

Google says it has seen no real-world abuse yet. However, the risk grows now that details are public.

If you suspect compromise, factory reset your headphones. Keep the official app installed. Apply firmware updates immediately when available.

Convenience should not become a surveillance tool. Google Fast Pair remains powerful, but WhisperPair shows how a small flaw can create a silent risk at scale.