CVE-2025-36911
Published: 15 January 2026
Summary
CVE-2025-36911 is a high-severity an unspecified weakness vulnerability in Google Android. Its CVSS base score is 7.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Data from Local System (T1005); ranked at the 0.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 AC-18 (Wireless Access) and SC-40 (Wireless Link Protection).
Deeper analysis
CVE-2025-36911 is a logic error in key-based pairing that enables information disclosure. This vulnerability affects Android Pixel devices, as documented in the January 2026 Pixel security bulletin.
The attack vector is adjacent (AV:A) with low complexity (AC:L), requiring no privileges (PR:N) or user interaction (UI:N). An attacker in proximal or adjacent range can remotely disclose sensitive user data, including conversations and location, with high confidentiality impact (C:H), low integrity impact (I:L), and no availability impact (A:N). The CVSS v3.1 base score is 7.1.
Mitigation details are provided in the Android Pixel security bulletin at https://source.android.com/docs/security/bulletin/pixel/2026/2026-01-01. Additional context on the affected component is available at https://whisperpair.eu/.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-2722
Vulnerability details
In key-based pairing, there is a possible ID due to a logic error in the code. This could lead to remote (proximal/adjacent) information disclosure of user's conversations and location with no additional execution privileges needed. User interaction is not needed…
more
for exploitation.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Logic error enables unauthorized adjacent-range disclosure of local device data (conversations, location), directly mapping to collection from local system sources.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly governs wireless pairing and authentication mechanisms whose logic error enables the adjacent information disclosure.
Requires protection of wireless links used for key-based pairing, blocking the proximal/adjacent eavesdropping vector.
Enforces access decisions during pairing so the flawed logic cannot grant unauthorized access to conversations and location.