Bluetooth Flaw Puts Millions of Premium Headphones at Spying Risk

Imagine rocking out to your favorite playlist, only to find out someone might be eavesdropping on more than just your music taste. A recent cybersecurity bombshell dropped by researchers at ERNW has uncovered a serious vulnerability in Bluetooth headphones and other audio devices using Airoha chips. This flaw affects 29 popular products from major brands like Bose, Sony, JBL, Jabra, and Marshall, spanning headphones, earbuds, speakers, and even wireless microphones.

The issue lies in three distinct flaws within the Airoha Bluetooth chips, rated from medium to high severity. These vulnerabilities could allow attackers in close proximity to access personal data, manipulate information, or even listen in on your conversations. In a chilling proof-of-concept, researchers demonstrated they could extract call logs, contact lists, and media playback—or worse, force your phone to make a call without your knowledge, turning your device into a spy tool.

What’s at stake? We’re talking about potential breaches that could let someone hijack your Bluetooth connection by impersonating your headphones. Once in, they can issue commands through the Hands-Free Profile, a feature on most modern phones, and hear everything your device picks up. It’s not a casual hack—it requires technical know-how and close range—but the implications are downright unsettling.

The good news? Airoha has rolled out a fix in their software development kit as of early June, and manufacturers are now tasked with pushing firmware updates to affected devices. The bad news? Some updates released before the fix may still leave devices vulnerable, and many users might not even know if their gear is patched since notifications are often silent or nonexistent.

What can you do? First, manually check for firmware updates through your manufacturer’s app or website—don’t rely on automatic prompts. Disable Bluetooth when you’re not using it to shrink your risk window. Be cautious in crowded public spaces where attackers could lurk nearby. And for goodness’ sake, clear out old or unfamiliar pairings in your Bluetooth settings to avoid sneaky reconnections.

This isn’t just about a tech glitch; it’s a wake-up call about the hidden software running our everyday gadgets. When flaws like this slip through the cracks, consumers are often left clueless. Shouldn’t manufacturers be upfront about security risks in our devices? Until transparency becomes the norm, it’s up to us to stay vigilant—and maybe keep the volume down on those private convos.