CVE-2025-36911

Published Jan 15, 2026

Last updated 3 months ago

WhisperPair

Google Fast Pair

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-36911, also known as "WhisperPair," is a vulnerability found in the key-based pairing process of Bluetooth audio accessories that utilize Google's Fast Pair protocol. The flaw stems from a logic error in the code, where devices may fail to properly verify if they are in pairing mode. This oversight allows an attacker in close physical proximity to exploit the vulnerability without requiring additional execution privileges or user interaction. Successful exploitation of CVE-2025-36911 can lead to remote information disclosure, potentially exposing users' conversations and location data. Attackers can forcibly pair vulnerable accessories with their own devices, gaining control over the audio device. This could enable actions such as playing audio at high volumes, recording conversations through the device's microphone, or tracking the user's location if the accessory supports Google's Find Hub network.

Description: In key-based pairing, there is a possible ID due to a logic error in the code. This could lead to remote (proximal/adjacent) information disclosure of user's conversations and location with no additional execution privileges needed. User interaction is not needed for exploitation.
Source: dsap-vuln-management@google.com
NVD status: Modified
Products: android

Risk scores

CVSS 3.1

Type: Secondary
Base score: 7.1
Impact score: 4.2
Exploitability score: 2.8
Vector string: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N
Severity: HIGH

Weaknesses

nvd@nist.gov: NVD-CWE-noinfo

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:o:google:android:-:*:*:*:*:*:*:*",
            "matchCriteriaId": "F8B9FEC8-73B6-43B8-B24E-1F7C20D91D26",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.