WhisperPair vulnerability is widespread: COSIC has confirmed that popular devices like the Sony WH-1000XM6, Pixel Buds Pro 2, Jabra Elite 8 Active, Soundcore Liberty 4 NC, and more are all susceptible to WhisperPair attacks. You can see a list of devices that have been tested here, but there’s reason to believe many more models may be vulnerable, as well.
COSIC first notified Google of its findings in August. According to Wired‘s write-up, Google has worked in coordination with the researchers to address WhisperPair. COSIC’s report says that “many manufacturers have released patches for their impacted devices,” but also that users should check with their audio accessory manufacturer for questions about WhipserPair patches.
There aren’t any confirmed cases of WhisperPair attacks taking place in the wild, and Google tells Wired that it hasn’t “seen evidence of any exploitation outside of this report’s lab setting.” Still, if you haven’t updated your headphones or earbuds lately, today seems like a great time to do it.
