Google Password Manager Attacks Could Let Malware Hijack Passkey-Protected Accounts

Unit 42 researchers have disclosed three attack paths against Google Password Manager in Chrome on Windows, which could allow malware already running on a victim’s device to compromise passkey-protected accounts. The attacks, named Pass-ta-key, Silver Pass-ta-key, and Golden Pass-ta-key, target the cloud authenticator’s implementation rather than breaking the underlying cryptography.

The first path, Pass-ta-key, extracts Chrome’s wrapped device identity key and uses the TPM to sign an attacker-controlled request, potentially obtaining a valid authentication assertion without user verification. The second, Silver Pass-ta-key, exploits a window during device re-enrollment to register an attacker-controlled user-verification key. The third, Golden Pass-ta-key, aims to extract the 32-byte Security Domain Secret (SDS) from Chrome’s memory, which could allow decryption of synced passkey private keys.

All three paths require prior endpoint compromise and are limited to Windows systems with TPM. The researchers note that no CVE identifiers have been assigned, and the disclosure does not confirm whether the latest stable Chrome remains vulnerable. Relying parties are advised to enforce user verification checks, and credential providers should strengthen device attestation and recovery processes.