Researchers at Palo Alto Networks demonstrated novel attack techniques against Google’s synced passkey system used in Chrome on Windows. The Pass-ta-key attack involves malware accessing the local synchronization database to identify passkey-protected accounts and associated encrypted credentials. The malware recovers a device identity key and uses Windows cryptographic APIs to generate valid authentication signatures without biometric prompts or device unlocks, tricking Google’s cloud authenticator into issuing valid assertions. The Silver Pass-ta-key variant forces Chrome into device re-registration to register attacker-controlled keys, enabling remote authentication. The Golden Pass-ta-key technique extracts a master secret from Chrome’s memory during re-enrollment, allowing decryption of all synchronized passkeys. These methods bypass protections typically provided by passkeys and passwordless authentication. Google has been informed and has implemented mitigations.

The attacks enable malware to hijack accounts protected by Google’s synced passkeys without requiring user interaction, privilege escalation, or biometric verification. This compromises the security benefits of passkeys, potentially allowing attackers full account takeover. The Golden Pass-ta-key variant is especially severe, as it allows decryption of all synchronized passkeys for the account, enabling persistent and broad access. These attacks undermine the trust model of passwordless authentication relying on device-bound credentials.

Google has been notified of these attack methods and has rolled out mitigations to address them. Users should ensure their Chrome browsers and related software are updated to the latest versions incorporating these fixes. No additional user action is specified or required at this time according to the vendor disclosure. Organizations should monitor vendor advisories for further updates.