# CVE-2025-36911

In key-based pairing, there is a possible ID due to a logic error in the code. This could lead to remote (proximal/adjacent) information disclosure of user's conversations and location with no additional execution privileges needed. User interaction is not needed for exploitation.

- Page: https://www.vulneraibility.com/cve/CVE-2025-36911
- CVSS: 7.1
- Known exploited: not in CISA KEV as of our last sync
- EPSS: 8.41% (percentile 95.1)
- Unvetted proof-of-concept code on GitHub: 11 GitHub proofs of concept (first 2026-01-17)
- CISA SSVC: exploitation none, automatable no, technical impact partial (assessed 2026-01-15)
- Published: 2026-01-15

## Affected versions

- Google Android: affected Android kernel

A version outside these ranges is not a statement that it is unaffected.

## References

- [advisory] https://source.android.com/docs/security/bulletin/pixel/2026/2026-01-01
- [advisory] https://whisperpair.eu/

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.