The Pass-ta-key attacks exploit design and implementation weaknesses in Google Password Manager's handling of synced passkeys on Windows devices running Chrome with TPM. The first attack impersonates a trusted device to obtain valid authentication assertions without user interaction, but fails if the relying party properly validates user verification flags. The second attack, Silver Pass-ta-key, allows malware to register attacker-controlled user-verification keys, bypassing user verification requirements. The third and most severe, Golden Pass-ta-key, enables extraction of the master encryption key (security domain secret) from Chrome's process memory during device re-registration, allowing decryption of all synced passkeys and their private keys. These attacks do not break the underlying cryptography but exploit trust and key management flaws. Researchers recommend proper validation of user verification by services, stricter credential manager controls, and protection of master keys in memory. Google has been notified but has not publicly confirmed full fixes.

Malware already present on a victim's Windows device can abuse Google Password Manager's synced passkeys to take over user accounts by impersonating trusted devices and bypassing user verification in some cases. Attackers can register their own verification keys to bypass user verification requirements and extract the master key used to encrypt all synced passkeys, enabling decryption and theft of private keys. This compromises the security of passkey-based authentication for affected users, potentially allowing account takeover and persistent access. The attacks do not compromise passkey cryptography itself but exploit weaknesses in device trust, key registration, and memory handling. Some affected services have fixed validation flaws, but the master key exposure remains a critical concern.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Researchers disclosed these issues to Google and affected services such as eBay, which has fixed related user verification validation flaws. Until official fixes are confirmed, websites should require and properly validate user verification flags during passkey authentication. Credential managers should validate newly registered device keys, harden recovery and device re-registration processes, and prevent master keys from being accessible in browser memory. Users should ensure their devices are free from malware, as these attacks require pre-existing compromise. Monitor vendor advisories for updates on patches or official mitigations.