Skip to content
OpenAdvisories
High · 7.1 Public exploit CVE-2025-36911 EUVD-2026-2722GHSA-6fxf-xg6m-34hj

In key-based pairing, there is a possible ID due to a logic error in the code. This could lead to remote (proximal/adjacent) information di…

Published Jan 15, 2026 · Updated Jan 28, 2026 · Assigned by Google_Devices

Vendor: Google Product: Android Platform: Android

Description

In key-based pairing, there is a possible ID due to a logic error in the code. This could lead to remote (proximal/adjacent) information disclosure of user's conversations and location with no additional execution privileges needed. User interaction is not needed for exploitation.

Affected products

VendorProductAffectedFixed
Google Android Android kernel —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 11 repositories · most starred shown

  • zalexdev/wpair-app ★ 865 · Jan 17, 2026

    WPair is a defensive security research tool that demonstrates the CVE-2025-36911 (eg WhisperPair) vulnerability in Google's Fast Pair protocol. This vulnerability affects millions of Bluetooth audio …

  • KULeuven-COSIC/WhisperPair ★ 116 · Mar 30, 2026

    The official reference implementation & vulnerability verification of our attack WhisperPair (CVE-2025-36911) which affects Google's Fast Pair protocol.

  • SpectrixDev/DIY_WhisperPair ★ 107 · Jan 17, 2026

    Hijacking Bluetooth Accessories Using Google Fast Pair: WhisperPair CVE-2025-36911 Reference Implementation & Vulnerability Verification Toolkit

  • Ymsniper/Whisper_Bully ★ 41 · Jul 7, 2026

    Three-stage Bluetooth BDADDR extraction, DoS & hijack on Fast Pair devices; unpatched primitives outside CVE-2025-36911 scope (no Ubertooth needed)

  • PentHertz/CVE-2025-36911-exploit ★ 27 · Jan 27, 2026

    Exploit of the CVE-2025-36911 vulnerability in Python for testing our own equipment

  • PivotChip/FrostedFastPair ★ 15 · Jan 20, 2026

    WhisperPair (CVE-2025-36911) POC for ESP32 device

  • aalex954/whisperpair-poc-tool ★ 8 · Jan 25, 2026

    A security research tool that identifies and demonstrates the CVE-2025-36911: Fast Pair Pairing Mode Bypass vulnerability

  • Cedric-Martz/CVE-2025-36911_scan ★ 3 · Jan 17, 2026

    This script can be used to check if a Bluetooth device is vulnerable to CVE-2025-36911.

  • markmysler/wpair-cli ★ 2 · Jan 19, 2026

    Defensive scanner for CVE-2025-36911, the Google Fast Pair Bluetooth vulnerability.

  • SteamPunk424/CVE-2025-36911-Wisper_Pair_Target_Finder ★ 2 · Jan 17, 2026

    This is not an exploit for CVE-2025-36911!!! This is a detector for finding potentially vulnerable devices! Only use on your own devices! I am not responsible for damages!

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Advisories 1

References