CVE-2025-36911
In key-based pairing, there is a possible ID due to a logic error in the code. This could lead to...
In key-based pairing, there is a possible ID due to a logic error in the code. This could lead to remote (proximal/adjacent) information disclosure of user's conversations and location with no additional execution privileges needed. User interaction is not needed for exploitation.
Attack profile
How easy it is to exploit
- Attack vector
- Adjacent network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
In key-based pairing, there is a possible ID due to a logic error in the code. This could lead to remote (proximal/adjacent) information disclosure of user's conversations and location with no additional execution privileges needed. User interaction is not needed for exploitation.
- Record
CVE-2025-36911- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N - Updated
- 2026-11-02
EUVDEUVD-2026-2722
In key-based pairing, there is a possible ID due to a logic error in the code. This could lead to remote (proximal/adjacent) information disclosure of user's conversations and location with no additional execution privileges needed. User interaction is not needed for exploitation.
- Record
EUVD-2026-2722- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-6fxf-xg6m-34hj
In key-based pairing, there is a possible ID due to a logic error in the code. This could lead to...
In key-based pairing, there is a possible ID due to a logic error in the code. This could lead to remote (proximal/adjacent) information disclosure of user's conversations and location with no additional execution privileges needed. User interaction is not needed for exploitation.
- Record
GHSA-6fxf-xg6m-34hj- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N - Updated
- 2026-11-02
NVD
In key-based pairing, there is a possible ID due to a logic error in the code. This could lead to remote (proximal/adjacent) information disclosure of user's conversations and location with no additional execution privileges needed. User interaction is not needed for exploitation.
- Record
CVE-2025-36911- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N - Updated
- 2026-11-02
OSVPUB-A-445196906 No score
In key-based pairing, there is a possible ID due to a logic error in the code. This could lead to remote (proximal/adjacent) information disclosure of user's conversations and location with no additional execution privileges needed. User interaction is not needed for exploitation.
- Record
PUB-A-445196906- Updated
- 2026-11-09
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
:unknown:Android |
Pixel-family specific:0 up to Pixel-family specific:2026-01-05, plus listed versions Pixel-family specific |
Pixel-family specific:2026-01-05 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| PoC in GitHub | Cedric-Martz/CVE-2025-36911_scan | 2026-01-17 |
| PoC in GitHub | SpectrixDev/DIY_WhisperPair | 2026-01-17 |
| PoC in GitHub | SteamPunk424/CVE-2025-36911-Wisper_Pair_Target_Finder | 2026-01-17 |
| PoC in GitHub | zalexdev/wpair-app | 2026-01-17 |
| PoC in GitHub | markmysler/wpair-cli | 2026-01-19 |
| PoC in GitHub | PivotChip/FrostedFastPair | 2026-01-20 |
| PoC in GitHub | ap425q/whisper-pair | 2026-01-21 |
| PoC in GitHub | aalex954/whisperpair-poc-tool | 2026-01-25 |
| PoC in GitHub | PentHertz/CVE-2025-36911-exploit | 2026-01-27 |
| PoC in GitHub | KULeuven-COSIC/WhisperPair | 2026-03-30 |
| PoC in GitHub | Ymsniper/Whisper_Bully | 2026-07-07 |
History
| Recorded | Changed | Sources |
|---|---|---|
| exploits, facts | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-36911 is a high vulnerability (CVSS 7.1) in Google Android, published January 1, 2026. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 8.41%, the 95th percentile. Fixed in :unknown: Pixel-family specific:2026-01-05.