Windows Malware Bypasses Google Chrome Passkeys, Researchers Reveal

Researchers from Palo Alto Networks’ Unit 42 have uncovered three attack paths that allow Windows malware to bypass passkeys managed by Google Password Manager in the Google Chrome browser. The research highlights that while passkey cryptography remains secure, the surrounding software implementations, synchronization features, and server-side verification practices can be compromised.

Windows Malware Exploits Reveal Vulnerabilities in Google Chrome Passkeys

According to reports from PCMag and Malwarebytes, every attack path requires a Windows computer that has already been infected with malware running as an ordinary user. The techniques do not break underlying public-key cryptography, but instead target how Chrome stores device keys, how devices re-enroll, and whether relying websites properly validate user verification flags.

The Three Attack Paths: Pass-Ta-Key, Silver, and Golden

The research details three distinct post-compromise techniques collectively referred to as Pass-Ta-Key attacks:

Windows Malware Bypasses Google Chrome Passkeys, Researchers Reveal — Photo: The Hacker News

* Pass-Ta-Key: Malware on an infected device silently interacts with Chrome and Google’s cloud authenticator to create a valid passkey login without requiring a biometric scan or PIN prompt. According to 9to5google.com, this initial method only worked on eBay because the service did not validate whether the user verification process actually occurred. Sites requiring robust user verification are not vulnerable to this specific baseline method. * Silver Pass-Ta-Key: Malware abuses device re-enrollment processes. During the window where Chrome re-enrolls the device and does not immediately create its user-verification key, attackers can register their own attacker-controlled verification key. The service fails to check if the newly registered key originated from secure hardware, allowing the attacker to log in as the victim from a remote machine. * Golden Pass-Ta-Key: Described as the strongest and most dangerous method by The Hacker News, malware triggers device re-enrollment and extracts the 32-byte Security Domain Secret (SDS) directly from Chrome’s process memory while it briefly sits in plaintext.

Data Exposure and Master Key Extraction

Under the hood, Chrome stores synchronized credential records locally under `%LocalAppData%GoogleChromeUser DataSync DataLevelDB`. Unprivileged malware processes can read metadata from this database to identify usernames, relying parties, credential identifiers, and encrypted private-key material.

By obtaining the 32-byte SDS master encryption key in the Golden Pass-Ta-Key attack, malicious actors can decrypt all of the user’s synchronized passkeys. This grants attackers the ability to sign future passkey requests as if they were legitimate, potentially providing persistent account access. Unit 42 noted that while Google has removed the master secret from Chrome’s logging output, the security domain secret is still sent to the client and remains accessible in Chrome’s process memory.

Defense and Mitigation Strategies

Security researchers have urged both service providers and developers to update their validation practices. Specifically, passkey authenticators and relying websites are advised to stop blindly trusting user verification flags and to rigorously verify that a genuine biometric or PIN event occurred before granting access. Additionally, vendors are encouraged to harden device registration and recovery mechanisms to ensure new keys are backed by secure hardware.

Google Chrome Passkeys Under Attack: What You Need to Know!

For end users, experts emphasize that passkeys continue to offer robust protection against traditional phishing websites and credential stuffing. However, because endpoint and onboarding weaknesses in Google Chrome can be exploited when malware is present, maintaining strict anti-malware hygiene, applying system patches promptly, and using real-time security software remain critical defenses.