CVE-2025-36911
HIGH 7.1EPSS 8.4%
In key-based pairing, there is a possible ID due to a logic error in the code. This could lead to remote (proximal/adjacent) information disclosure of user's conversations and location with no additional execution privileges needed. User interaction is not needed for exploitation.
- Affected
- Google · Android
- CVSS v3.1 CNA
- 7.1 HIGH
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N - EPSS
- 8.41% chance of exploitation in the next 30 days, 95th percentile
- Published
- 2026-01-15
- Updated
- 2026-01-28
Proof-of-concept exploits (11)
- xarlord/btsec-testtool1★ · 2026-09-06
- PentHertz/CVE-2025-36911-exploit27★ · 2026-01-28
- PivotChip/FrostedFastPair15★ · 2026-01-31
- SteamPunk424/CVE-2025-36911-Wisper_Pair_Target_Finder2★ · 2026-01-18
- aalex954/whisperpair-poc-tool8★ · 2026-01-25
- Bazskillz/WhisperPair-PoC15★ · 2026-01-26
- ekomsSavior/whisper56★ · 2026-02-04
- pira12/WhisperPair-PoC1★ · 2026-04-23
- zr0n/zwhisper-android25★ · 2026-01-26
- zr0n/zwhisper-linux21★ · 2026-01-26
- zr0n/zwhisper-windows5★ · 2026-01-26