Vulnerability Discovered in Google Fast Pair Allowing Hackers to Compromise Most Bluetooth Earbuds

Cybersecurity researchers have uncovered a critical vulnerability in Google's Fast Pair protocol, impacting millions of wireless audio devices. The flaw allows malicious actors to connect to earbuds and speakers without the owner's knowledge, enabling them to eavesdrop on surroundings and, in some cases, track the device's location.

The Fast Pair protocol, developed by Google to simplify connecting Bluetooth devices to Android and ChromeOS, contains implementation-level vulnerabilities in the devices themselves. Specialists from KU Leuven University identified the issue, dubbing it "WhisperPair," across 17 device models from 10 manufacturers: Sony, Jabra, JBL, Marshall, Xiaomi, Nothing, OnePlus, Soundcore, Logitech, and Google itself. The attack requires being within Bluetooth range (up to 15 meters) and knowing the target device's model identifier. The compromise takes 10-15 seconds. Once successfully connected, an attacker can:

The most severe threat concerns Google Pixel Buds Pro 2 and certain Sony models. If these devices were not previously linked to a Google account (for example, were used only with an iPhone), an attacker can link them to their own account. This grants access to the Find Hub feature, which tracks the device's geolocation via connections to nearby devices. Researchers note that even if Google's or Apple's security system alerts a user to potential tracking, they are likely to ignore the notification—it would point to their own device as the source of the tracking.

The problem stems from implementation errors of the Fast Pair standard by both finished device manufacturers and chip developers (Actions, Airoha, Bestechnic, MediaTek, Qualcomm, Realtek). Notably, all tested devices had Google certification for Fast Pair compliance. The researchers themselves state that a fundamental solution requires cryptographic owner verification and blocking secondary pairing without authentication.

This situation highlights the classic convenience-versus-security dilemma: the Bluetooth protocol itself does not contain these vulnerabilities—the problems arose in the overlay designed to simplify the user experience. Google has issued a statement about collaborating with the researchers and has released updates for its own devices and the Find Hub service.