Researchers presented at 39C3 three high-severity vulnerabilities (CVE-2025-20700, CVE-2025-20701, CVE-2025-20702) in Airoha Bluetooth audio chips that let attackers read and write device memory via the custom RACE protocol. By extracting Bluetooth Link Keys from headphone flash memory, attackers can impersonate your trusted Sony, Marshall, or Jabra headphones to compromise your paired smartphone, enabling eavesdropping, call hijacking, and data theft. The full disclosure from Insinuator has all the gory details, and they’ve released the RACE Toolkit so you can check if your overpriced earbuds are also a liability. HN discussion available for those who enjoy existential dread about their earbuds.
