Google Password Manager Attacks Could Let Malware Hijack Passkey-Protected Accounts
Google Password Manager attacks could let malware hijack passkey-protected accounts without a fingerprint, PIN, or any other authentication factor appearing on the victim's screen. Unit 42 detailed three attack paths against Chrome's Google Password Manager cloud authenti…
Intelligence analysis by Llama
Malware running as an ordinary user on a Windows machine can sign into a victim's passkey-protected accounts without any authentication factor appearing on the victim's screen. The attacks target the code around the passkey, not the cryptography itself.
Imagine you have a super-secure lock on your front door. But, an attacker can trick the lock into thinking they're you, even if they don't have the key. This is like what's happening with Google Password Manager. The attackers are finding ways to trick the system into thinking they're the real user, even if they don't have the password or fingerprint.
Analysis
A $60B Vote of Confidence
Unit 42 detailed three attack paths against Chrome's Google Password Manager cloud authenticator, which it calls Pass-ta-key, Silver Pass-ta-key, and Golden Pass-ta-key. The attacks target the code around the passkey, not the cryptography itself. The first technique, Pass-ta-key, extracts Chrome's wrapped device identity key and asks the same TPM to sign an attacker-controlled request through Windows Cryptography API: Next Generation (CNG) calls. The current Chromium source shows why that blob is reusable: Chrome creates the TPM key without a key name, which a comment in the code says stops it being persisted to disk. Chrome then exports the key as an opaque blob and reloads it later under a flag that suppresses any prompt. A TODO in the same file points to Chromium issue 398125799, proposing that those keys be labelled instead. Google Cloud Authenticator returns a valid assertion, and the only thing separating it from one produced after a real user check is a single bit, the User Verified (UV) flag, left unset. The current Web Authentication specification says a relying party that sets userVerification to required must fail the ceremony when that bit is absent. The researchers said GitHub enforced the check, while eBay accepted its test assertion until the company fixed the validation gap following disclosure. Of the three paths, this is the one that turns on a check the relying party controls, so a site can fail it regardless of how the cloud service behaves, and of the two Unit 42 names, one did.
Why Cursor?
Silver Pass-ta-key targets the next layer. Malware forces Chrome to re-enroll the device. Chrome does not create its user-verification key immediately, and in that window an attacker can register one of their own instead. Unit 42 said the service does not check whether a newly registered key came from secure hardware. Assertions signed with that key carry the UV flag, which the researchers said enables later logins without the victim's device. Current Chromium source independently confirms that newly registered devices can retain a deferred_uv_key_creation state, but the public code alone does not verify the reported server-side key-substitution attack against the latest stable Chrome release. The disclosure does not say whether the production service now checks hardware attestation before accepting a replacement key, a check Unit 42 recommends to mitigate this path.
The Road Ahead
Golden Pass-ta-key goes after the SDS itself. Unit 42 said malware can trigger re-enrollment, read the secret out of Chrome's process memory while it briefly sits there in plaintext, and use it to recover synchronized passkey private keys. Current Chromium source corroborates the underlying exposure: Chrome creates or receives 32-byte security-domain secrets in client-process data structures. That confirms the secret enters Chrome memory, though reliable extraction, account takeover, and persistence across future secret epochs remain sourced to Unit 42 or unresolved. The researchers said Google removed an earlier SDS exposure from Chrome's FIDO logs and that eBay now validates the UV flag. It said the secret still reaches the client and stays in Chrome's memory, so the logging change does not close the path it describes. The disclosure does not establish whether all three attack paths have been closed. As of August 3, 2026, searches of Google's public Chrome materials and eBay's support and press pages found no notice documenting either reported change, and none of them describes a way for a user to check whether an SDS was exposed. Google's public support documentation lets users change their Google Password Manager PIN or delete all Password Manager data, but it does not describe an SDS-specific rotation or revocation control.
Key points
- Unit 42 detailed three attack paths against Chrome's Google Password Manager cloud authenticator.
- The attacks target the code around the passkey, not the cryptography itself.
- The first technique, Pass-ta-key, extracts Chrome's wrapped device identity key and asks the same TPM to sign an attacker-controlled request through Windows Cryptography API: Next Generation (CNG) calls.
- The second technique, Silver Pass-ta-key, targets the next layer and malware forces Chrome to re-enroll the device.
- The third technique, Golden Pass-ta-key, goes after the SDS itself and malware can trigger re-enrollment, read the secret out of Chrome's process memory while it briefly sits there in plaintext, and use it to recover synchronized passkey private keys.
Google has already removed an earlier SDS exposure from Chrome's FIDO logs, and eBay now validates the UV flag. This suggests that Google and other companies are taking steps to address these vulnerabilities and improve the security of their password managers.
The attacks described by Unit 42 are complex and require a high level of technical expertise. However, if an attacker is able to successfully exploit these vulnerabilities, they could potentially gain access to a user's passkey-protected accounts without any authentication factor appearing on the victim's screen.
