Google Password Manager Flaw Exposes Synced Passkeys to Silent Hijacking

DNI SUMMARY — KEY POINTS

• Security researchers at Unit 42 have identified three sophisticated attack vectors targeting the synchronization infrastructure used by Google Password Manager to manage passkeys.
• The identified techniques allow malware already running on a compromised Windows machine to authenticate as a user without triggering any standard verification prompts.
• Experts emphasize that while these exploits do not break the core public-key cryptography of passkeys, they successfully manipulate the surrounding cloud storage and device-trust mechanisms.
• The most dangerous method could allow attackers to extract the master cryptographic key that secures a user's entire repository of synced passkey private keys.
• Google has not yet released specific patches or CVE identifiers for these post-compromise techniques which rely on local machine access and TPM-enabled hardware.

A significant security vulnerability has emerged within the ecosystem of Google Password Manager, raising serious questions about the safety of passwordless authentication. Researchers from Unit 42 have detailed three novel attack paths that enable malware to hijack passkey-protected accounts on Windows systems. Rather than attempting to break the robust public-key cryptography that underpins the FIDO standard, these attacks exploit weaknesses in the supporting infrastructure. By compromising a device, an attacker can bypass user verification steps such as fingerprints or PINs to gain unauthorized account access.

Architecture Vulnerabilities in Syncing

The research centers on the synchronization architecture that allows Google Chrome to store and manage passkeys across multiple devices. The identified methods, dubbed Pass-ta-key, Silver Pass-ta-key, and Golden Pass-ta-key, function as a progression of post-compromise escalation techniques. These tactics demonstrate how an unprivileged process can interact with the local storage files where credential metadata is kept. By leveraging the Windows Cryptography API (CNG), attackers can trick the system into signing authentication requests, effectively masquerading as the legitimate user without leaving an obvious trail.

Perhaps the most alarming finding involves the potential for complete data exfiltration. The most advanced attack path allows for the extraction of the 32-byte Security Domain Secret, which serves as the master cryptographic key for the entire synchronization process. Possession of this secret effectively grants an attacker the ability to decrypt and potentially replicate the entire library of a user's passkeys. Because this secret is central to how Google manages synced credentials, the vulnerability highlights the inherent risks of consolidating sensitive security keys within a single cloud-based storage system.

Persistent Threats After Compromise

The security research is specifically limited to systems equipped with a Trusted Platform Module (TPM) running the Chrome browser on Windows. While the researchers confirmed that the architecture allows for these exploits, they noted that the attack requires the presence of active malware on the victim's device. This means the vulnerability does not allow for remote, zero-click account takeovers. However, the ability to maintain persistent access after an initial compromise remains a critical concern for both enterprise security teams and individual users who rely on passwordless logins.

Current industry practices for passkey deployment often prioritize user convenience by enabling seamless syncing across devices. This approach, while helpful, fundamentally shifts the trust boundary from the local device to the Cloud Authenticator ecosystem. Security experts at the FIDO Alliance have previously cautioned that syncing features in consumer services may introduce broader attack surfaces compared to device-bound keys. This incident serves as a stark reminder that even cutting-edge security technologies are only as resilient as the infrastructure that supports their lifecycle and management.

Broader Browser Security Concerns

The discovery arrives alongside broader concerns about browser-based credential security and extension vulnerabilities. Another researcher recently highlighted how clickjacking techniques could be used to manipulate user interface elements, tricking people into revealing sensitive data. While the mechanisms differ, both issues point toward the same problem: the complexity of browser-based authentication processes provides ample room for malicious actors to hide their activity. These findings collectively argue for a more rigorous approach to how browsers handle sensitive security ceremonies and user prompts.

Responding to these developments requires a layered security strategy rather than reliance on any single authentication feature. Users should treat their browser environment as a high-value target and prioritize endpoint protection to prevent the initial malware infection that makes these attacks possible. Organizations should evaluate whether to mandate device-bound passkeys for sensitive corporate accounts, as these keys remain isolated from the vulnerabilities inherent in cloud-synced repositories. This shift could significantly reduce the impact of potential future breaches involving synced credential databases.

Defining Future Security Standards

Looking forward, the industry must address the lack of transparency regarding these specific architectural flaws. With no CVE identifiers currently assigned, the timeline for potential software updates remains unclear. Palo Alto Networks continues to monitor the threat landscape, providing tools that help protect users against such unauthorized access. As the transition to passwordless authentication accelerates, the security community must maintain a vigilant eye on how major technology providers handle the complex interdependencies between local machine hardware and cloud-based authentication services.