New Pass-ta-key Vulnerabilities Expose Hidden Risks in Google Password Manager Security

DNI SUMMARY — KEY POINTS

• Researchers from Unit 42 have discovered three sophisticated attack methods capable of hijacking passkey-protected accounts on Windows systems infected with malicious software.
• The identified techniques, collectively named Pass-ta-key, exploit the synchronization and authentication infrastructure rather than breaking the core public-key cryptography of passkeys.
• These attacks allow adversaries to bypass biometric or PIN requirements by manipulating Chrome's communication with Google cloud services during authentication or device re-enrollment.
• The most severe variant, Golden Pass-ta-key, enables the extraction of the master Security Domain Secret, potentially allowing attackers to decrypt and access all synced credentials.
• Experts emphasize that while these methods require prior endpoint compromise, they represent a critical warning regarding the future of passwordless authentication security standards.

Security researchers at Unit 42 have unveiled a series of unsettling vulnerabilities within Google Password Manager that threaten the integrity of modern passwordless authentication. These findings, dubbed the Pass-ta-key attack surface, demonstrate how attackers with existing access to a Windows machine can hijack passkeys without requiring biometric verification or a PIN. While passkeys were designed to render traditional phishing obsolete, these attacks shift the focus toward the underlying infrastructure that manages these digital credentials. The research highlights a significant reality in cybersecurity where the software implementation surrounding robust cryptographic protocols remains a primary target for sophisticated adversaries.

Vulnerabilities in Authentication Infrastructure

The core of the issue lies not in the failure of public-key cryptography itself, but in the implementation of Chrome and its cloud-based synchronization mechanisms. When a user creates a passkey, the system relies on a complex chain of trust involving local hardware and remote authentication services. The researchers found that malware could exploit this chain by masquerading as a legitimate user after the device has been compromised. By intercepting these requests, attackers successfully mimic the behavior of authorized hardware, effectively tricking websites into granting access without ever triggering the expected user verification prompts or multi-factor challenges.

The initial, and most foundational, attack technique allows malware to impersonate a trusted device by leveraging the Windows Cryptography API. In this scenario, the malicious process extracts device identity information stored by the browser to sign authentication requests directly. Because the cloud service relies on this signature to verify the source, it treats the fraudulent request as perfectly authentic. This bypasses the need for the human element entirely, proving that even well-designed security systems can be undermined if the browser-level trust parameters are improperly configured or susceptible to local modification by persistent malware.

Exploiting Local Browser Trust

Taking the threat further, the Silver Pass-ta-key variant forces a re-registration process that compromises the long-term security of an account. During the chaotic window where a browser re-enrolls a device, the attacker injects their own verification keys into the authentication flow. This creates a persistent backdoor that survives the initial login session, granting the threat actor recurring, unauthorized access to the victim’s services. This method highlights the danger of relying on automated recovery flows, which often provide an opening for attackers to establish a more permanent foothold within the user's digital identity landscape.

The most severe and dangerous of the three methods, dubbed Golden Pass-ta-key, targets the Security Domain Secret that serves as the master key for all synchronized credentials. By dumping sensitive memory from the Chrome process, researchers were able to retrieve this 32-byte secret, which acts as the root of trust for the entire cloud synchronization environment. Possessing this master secret is catastrophic, as it allows an attacker to decrypt not only current passkeys but also any future credentials stored within the synchronized vault, providing long-term, irreversible access to the victim's online presence.

Persistent Threats Through Re-registration

These findings serve as a stark reminder that the transition to passwordless technology is not a total solution for digital safety. While passkeys remain significantly more resistant to remote phishing than traditional passwords, the Google ecosystem’s reliance on seamless syncing across devices creates a massive, centralized target for attackers. The convenience of having passkeys available on every desktop and mobile device necessitates a higher standard of protection for the synchronization keys themselves. As long as these master secrets reside in memory, they remain vulnerable to local extraction by advanced malware strains.

Response from the industry has been swift, with researchers stressing the necessity for websites to perform stricter validation of the User Verified flag. Currently, many platforms blindly accept the successful assertion from the browser without verifying that a hardware-backed biometric event actually occurred on the client side. By hardening this check, service providers can significantly reduce the efficacy of these attacks, even if the local machine is compromised. The responsibility, therefore, sits with both the browser vendors to secure the storage of these keys and the website developers to implement robust, tamper-resistant authentication verification.

Strengthening Future Security Standards

Moving forward, the industry must prioritize the hardening of device registration and recovery processes to prevent similar vulnerabilities from appearing in the future. Palo Alto Networks researchers urge organizations to treat passkey infrastructure with the same level of caution as sensitive financial data. Although no evidence of these attacks currently exists in the wild, the disclosure provides a critical roadmap for defenders to proactively close these gaps. Protecting the future of passwordless login will require constant vigilance and a deeper focus on the often-overlooked implementation details that power our most secure technologies.