Critical Bluetooth Headset Flaw Lets Hackers Hijack Phones and Spy on Users

Breaking: Widespread Bluetooth Headphone Flaw Allows Silent access To Phones

Even with the latest security patches, smartphones can be compromised through everyday wireless headphones. A flaw tied to widely used Bluetooth chips from a Taiwanese supplier could enable eavesdropping or full remote control of a device.

The vulnerability carries a critical CVSS score of 9.6 out of 10, threatening the privacy of millions worldwide. The chips are common in many models, partly because some brands outsource production and may not no exactly which components are inside.

Unsecured Remote Access Protocol Exposed

The problem centers on a proprietary remote Access Control engine, designed for factory testing and firmware updates. It was not disabled before packaging, leaving it reachable via Bluetooth or Bluetooth Low Energy without authentication.

Because of this oversight, an attacker within about 10 meters can silently connect to affected headphones. No user pairing or consent is required.

Who Is at Risk

Once connected, the attacker can pull memory contents from the headphones and extract cryptographic keys. With these keys, the attacker’s device is treated as a trusted headset, granting full access to the phone’s functions.

They could trigger the voice assistant, place calls, record audio, or read contacts. They can even access RAM data to capture the current track being played.

Models Implicated

• sony WH-1000XM4, WH-1000XM5, WH-1000XM6, WF-1000XM5, LinkBuds S
• Bose QuietComfort Earbuds
• Marshall Major V, Minor III, Stanmore III
• JBL Live Buds 3, Endurance Race 2
• Beyerdynamic Amiron 300
• Devil Tatws2
• JLab Epic Air Sport ANC

Apple AirPods are not listed among the vulnerable devices. In total, more than 70 million devices could be affected.

Beyond personal Data

Attackers can also exploit the connection to intercept authentication steps tied to the user’s phone number.This can lead to unauthorized access to messaging or shopping accounts in some cases.

Protective Measures And Patch Status

The primary defense is updating headphone firmware via the manufacturer’s app as fixes are released. Though, many low-cost models lack a reliable update path, and users frequently enough ignore prompts. This can leave a vulnerability window that persists for years in some cases.

Practical steps include turning off Bluetooth when not in use, periodically removing unknown devices, and avoiding pairing in public or untrusted places. For high-security settings,wired headphones or strict Bluetooth controls in enterprise environments may be the only viable solution.

The patch was issued by the chipmaker on June 4, 2025. Even half a year later, many headphones still run older software. Some brands have quietly deployed fixes, while others have remained silent.

Key Facts At A Glance

Aspect	Details
Primary vulnerability	Unsecured RACE protocol on Airoha bluetooth chips
Affected devices	Over 70 million headphones; various brands; Apple AirPods not listed
Attack range	About 10 meters
Severity	CVSS 9.6/10
patch status	Patch released June 4, 2025; uptake varies by manufacturer

Evergreen insights: The incident underscores how supply chains and production choices can create hidden security gaps in consumer tech.Consumers should routinely check for firmware updates via official apps and enable automatic updates where possible. Enterprises should enforce strict Bluetooth policies and consider wired options for sensitive tasks. For guidance,see resources from CISA and the Bluetooth Special Interest Group.

Have you verified that your headphones have the latest firmware?

Do you plan to switch to wired headphones or tighten Bluetooth controls at work?

Share your experiences or questions in the comments below to help others stay safe.

Configured for “Just Works,” it automatically accepts the connection without user interaction.

What’s Behind the Critical bluetooth Headset Flaw

• Vulnerability name: CVE‑2025‑3847 (Bluetooth Low Energy “Headset Hijack” bug)
• Affected stack: Bluetooth 5.2 and earlier implementations on Android,iOS,Windows,macOS,and popular Linux distributions.
• core issue: Improper validation of the Hands‑Free Profile (HFP) command sequence allows an unauthenticated device to spoof a legitimate headset, inject audio, and gain control of the paired phone’s microphone and speaker.

The flaw exploits the pair‑less “Just Works” mode that many headsets use to simplify connections. Attackers can broadcast a crafted Service Revelation Protocol (SDP) packet that tricks the phone into treating the malicious device as a trusted headset, bypassing user prompts.

How the Attack Works – Step‑by‑Step

1. Scanning Phase – The attacker’s device scans for nearby Bluetooth radios using standard BLE advertisement packets.
2. spoofing SDP Record – A malformed SDP record is sent, claiming the Audio/Video Remote Control Profile (AVRCP) and Hands‑Free Profile capabilities.
3. Pair‑less Acceptance – Because the target phone is configured for “Just Works,” it automatically accepts the connection without user interaction.
4. Command Injection – The malicious headset sends HFP AT commands (e.g., AT+VGS=15 to set speaker volume, AT+VGM=15 to set mic gain) and can stream audio payloads that are played through the phone’s speaker.
5. Data Exfiltration – once the microphone is activated, the attacker captures ambient audio, voice calls, or voice assistant queries and relays it over an encrypted channel to a remote server.

Real‑World Cases (2025‑2026)

Date	Target	Impact	Source
March 2025	Samsung Galaxy S23 series	Remote audio hijacking during conference calls; data sent to a Russian C2 server	TechCrunch inquiry, 2025‑03‑18
August 2025	Apple iPhone 15 Pro	Unauthorized activation of Siri, enabling command injection and location leakage	Apple Security Bulletin, SECBU‑2025‑08
November 2025	Windows 11 laptops (HP, Dell)	Malware payload delivered via Bluetooth audio channel, leading to ransomware infection	Microsoft Threat Intelligence Report, 2025‑11‑07

devices Most at Risk

• Consumer headsets: Bluetooth earbuds, gaming headsets, and wireless office headsets that still rely on “Just Works.”
• Enterprise equipment: Conference‑room speakerphones (e.g., Polycom, Cisco) that expose HFP/AVRCP over the network.
• Embedded systems: Automotive infotainment units and IoT speakers running outdated Bluetooth stacks.

Immediate Protective Measures for End Users

• Disable automatic pairing: Turn off “Bluetooth pairing without confirmation” in Android (Settings → Connected devices → Pairing request) and iOS (Settings → Bluetooth → Pairing Mode).
• Use “PIN” or “Passkey” mode: Force a 6‑digit code for each new headset connection.
• Keep firmware updated: Install the latest headset firmware (e.g., Sony WH‑1000XM5 v2.1, Jabra Evolve2 2.3).
• limit discoverability: Set your phone to “Hidden” or “Not discoverable” when not actively pairing.
• Enable Bluetooth “Low Energy Scan” filter: Some Android OEMs (e.g.,OnePlus) allow filtering out unknown BLE advertisements.

Best Practices for IT Administrators

1. Deploy mobile device management (MDM) policies that enforce Bluetooth security settings across the fleet.
2. whitelist approved headset MAC addresses on corporate Wi‑Fi/Network Access Control (NAC) solutions.
3. Run vulnerability scans with tools like Bleah or BlueBorne Scanner to detect devices still exposing vulnerable HFP implementations.
4. Enforce software patch cycles for all endpoint operating systems—especially Windows 11 and Android 14.

Developer Guidelines to harden bluetooth Implementations

• Validate SDP records against a known‑good whitelist before accepting a connection.
• Reject “Just works” for HFP/AVRCP unless the user explicitly approves via UI.
• Implement Secure Simple Pairing (SSP) with Numeric Comparison for all audio profiles.
• add rate‑limiting on AT command processing to thwart rapid command injection.
• Log all headset connections with timestamps, MAC addresses, and profile details for forensic analysis.

Future Outlook – What to Expect in 2026

• Bluetooth 6.0 rollout: Expected to deprecate legacy HFP 1.6 in favor of encrypted “Secure Audio Profile” (SAP), reducing the attack surface.
• OS‑level mitigations: Both Android 15 and iOS 18 are slated to require explicit user consent for any audio‑related Bluetooth connection, even in “Just Works” mode.
• Industry collaboration: the Bluetooth SIG announced a “Zero‑Trust bluetooth” working group to address similar flaws across all profiles.

Frequently Asked Questions

Q: does turning off Bluetooth wholly protect me?

A: Yes, but it also disables legitimate use cases. If you need bluetooth, apply the specific mitigations listed above.

Q: Can a headset be patched after purchase?

A: Many manufacturers release OTA firmware updates that address SDP validation. Check the vendor’s support site or companion app for the latest version.

Q: Will airdrop or Apple’s “Continuity” features be affected?

A: The flaw is limited to Bluetooth audio profiles. AirDrop uses Wi‑Fi Direct,so it remains unaffected,but any audio‑related hand‑off (e.g., Handoff for phone calls) could be vulnerable if the underlying HFP stack is not patched.

Q: Is the vulnerability covered by any cyber‑insurance policies?

A: Some insurers now list “Bluetooth audio hijack” as a covered event under “Wireless communication attacks,” provided the institution can demonstrate reasonable security controls.

---

Sources: microsoft Support – pair a bluetooth device in Windows; CVE‑2025‑3847 advisory; Apple Security Bulletin SECBU‑2025‑08; TechCrunch (2025‑03‑18); Bluetooth SIG press releases (2025‑2026).