Recent research has uncovered a significant vulnerability in Google’s passkey synchronization system, allowing malware on compromised Windows PCs to hijack user accounts without requiring passwords, PINs, or biometric authentication. This discovery highlights critical flaws in Google’s Cloud Authenticator’s handling of device trust, onboarding, and recovery processes, undermining the security benefits passkeys are intended to provide.
Passkeys are designed to replace traditional passwords by utilizing public-key cryptography, thereby eliminating shared secrets that are susceptible to phishing and credential-stuffing attacks. However, researchers from Unit 42 have identified that Chrome stores passkey metadata locally in an unencrypted database. This setup enables malware to access information about all services where a user employs passkey login without needing elevated privileges.
The primary issue lies in Chrome’s management of the “identity key,” a hardware-backed credential meant to prove device possession to Google’s Cloud Authenticator. Instead of being permanently secured within the Trusted Platform Module (TPM), this key is generated as a temporary, exportable blob. Consequently, malware can extract this key and use standard Windows cryptography APIs to sign authentication requests, effectively replicating Chrome’s legitimate processes. This method, termed the “Pass-ta-key” attack, allows attackers to complete passkey logins without triggering any device unlock or biometric prompts.
Bypassing Multi-Factor Protections
More advanced variants of this attack further compromise security measures. The “Silver Pass-ta-key” attack involves deleting or corrupting the local passkey state file, prompting Chrome to initiate a re-onboarding process. During this period, the Cloud Authenticator may accept a newly registered, attacker-controlled verification key without validating its origin. This oversight grants the attacker a permanent method to authenticate as the victim from their own device, even for accounts with stringent multi-factor authentication requirements.
The most severe technique, known as the “Golden Pass-ta-key” attack, targets the master encryption key that protects all of a user’s synced passkeys, referred to as the security domain secret (SDS). Researchers found that this 32-byte secret was briefly exposed in Chrome’s internal logs and remains accessible in memory during device recovery. By extracting this key, an attacker can decrypt every passkey associated with an account, both past and future. This access persists even after the compromise is detected, as Google currently lacks a mechanism to rotate this master key.
It’s important to note that these attacks do not compromise the cryptographic integrity of passkeys themselves. Instead, they exploit gaps between design assumptions and real-world implementations, particularly concerning the trust placed in client devices and inconsistent validation by relying parties. Some affected services, such as eBay, have already addressed these verification gaps following responsible disclosure.
To mitigate these risks, security experts recommend several measures: strictly enforcing user-verification checks, validating device key attestation before registration, restricting local access to browser credential stores, and monitoring for unexpected re-triggering of onboarding or recovery processes.
This revelation underscores the necessity for continuous evaluation and enhancement of security protocols, especially as the industry moves toward passwordless authentication methods. While passkeys offer a promising alternative to traditional passwords, their implementation must be meticulously managed to prevent new vulnerabilities from emerging.
