New AirSnitch Wi-Fi Attack Breaks WPA3 Encryption

Researchers from the University of California have discovered a new attack named AirSnitch, which allows a person connected to the same Wi-Fi network to intercept your data and perform “man-in-the-middle” attacks, even on WPA3-encrypted networks (via Ars Technica).

The findings, presented at the NDSS Symposium in February 2026, suggest that the “client isolation” feature many of us rely on in offices, airports, and even home guest networks is fundamentally broken across almost all major hardware brands.

In a typical home network, all your devices can usually talk to each other. For example, your phone might send a photo to your smart TV. However, in public spaces or office environments, security experts use “client isolation.” This feature is supposed to create a digital wall between users. AirSnitch proves that these walls are much thinner than we thought.

The researchers identified three main ways to bypass these security walls:

1. Abusing Group Keys: Wi-Fi networks use a shared key (the Group Temporal Key) to send broadcast messages to everyone at once. An attacker can hide a private message meant for just your device inside one of these “broadcast” packets. Your device will accept it, thinking it’s a legitimate network message, allowing the attacker to “whisper” malicious data directly to your computer.
2. Gateway Bouncing: Many routers only block direct device-to-device talk. AirSnitch bypasses this by sending data to the network’s “gateway” (the router) and tricking it into reflecting that data back to the victim. It’s like sending a letter to a post office with instructions to immediately redeliver it to your neighbour; the post office does the work, and the isolation rule is never technically broken.
3. Identity Spoofing: Because Wi-Fi doesn’t strictly link your hardware address (MAC address) to your encryption keys, an attacker can essentially “wear your identity” on the network. They can trick the system into sending your incoming internet traffic to their device instead of yours.

The team tested five popular home routers—including models from Netgear, TP-Link, and ASUS—as well as university enterprise networks. Every single one was vulnerable to at least one form of the AirSnitch attack.

Using a VPN is a highly effective way to add an extra layer of encryption that AirSnitch cannot break. Additionally, ensuring that websites you visit use “HTTPS” protects your most sensitive data from being read.