Google’s Fast Pair Vulnerability Lets Hackers Hijack Your Headphones in Seconds

Google’s ‘Fast Pair’ Bluetooth feature, designed to save you time, might now be giving hackers a golden shortcut into your private conversations.

A vulnerability called WhisperPair allows attackers to hijack Fast Pair-enabled Bluetooth devices within 14 meters in as little as 10 seconds.

Researchers from KU Leuven University identified the flaw, which stems from an incomplete implementation of the Fast Pair standard. Affected brands include Sony, JBL, Nothing, OnePlus, and Google products. Manufacturers must release firmware updates to address the issue.

The exploit enables attackers to interrupt audio playback, play chosen audio, track location, and access microphones. Google has issued a patch for its devices, but researchers discovered a workaround.

Other manufacturers may take weeks or months to deploy fixes. Users cannot disable Fast Pair entirely, but factory resets and installing companion apps are recommended mitigations.

Kaspersky noted:

"The flaw arises from an incomplete implementation of the Fast Pair standard."