Privacy Threats Through Ultrasonic Side Channels on Mobile Devices [pdf]

The title is a little bit misleading, this is a case of an intentional covert channel (both communicating parties are controlled by the attacker, and one intentionally creates acoustic radiation that the other listens for), and not a side channel (where the attacker listens for unintentional acoustic emanations from a device they do not control, like https://www.tau.ac.il/~tromer/acoustic/).