A newly disclosed Bluetooth vulnerability could allow popular wireless headphones and earbuds to be used to spy on users or even hijack paired smartphones, security researchers warn.

The flaws affect Bluetooth chips made by Airoha Technology, a major supplier whose system-on-chips are used in products from Sony, Bose, JBL, Marshall, Jabra and others.

Impacted models include best-selling devices such as Sony’s WH-1000XM5 and WF-1000XM5, Bose QuietComfort Earbuds, JBL Live Buds 3 and several Marshall headphones that are widely sold across Australia.

Researchers from European cybersecurity firm ERNW discovered that an internal diagnostic protocol known as RACE (Remote Access Control Engine) was left exposed in many consumer devices.

RACE is designed for factory testing and servicing, but in affected products it can be accessed wirelessly over Bluetooth without proper authentication.

This means anyone within Bluetooth range could potentially connect to vulnerable headphones without the owner knowing. From there, attackers may be able to read device memory, intercept microphone audio, or impersonate the headphones to interact with a paired smartphone.

According to ERNW, the vulnerabilities range from high to critical severity. In practical terms, a successful attack could allow eavesdropping on calls, triggering voice assistants such as Siri or Google Assistant, or accessing data via a trusted Bluetooth connection.

Airoha has released an updated software development kit to hardware vendors and firmware updates are gradually rolling out.

However, patch availability varies by brand and model. Researchers say only a handful of manufacturers have clearly confirmed fixes so far, leaving many users uncertain about their exposure.

Consumers have been urged to check manufacturer apps or support pages for firmware updates and install them as soon as they become available.

Security experts also recommend removing unused Bluetooth pairings from phones, disabling Bluetooth when not needed and avoiding pairing devices in public places.