Google Password Manager Attacks Could Let Malware Hijack Passkey-Protected Accounts
Unit 42 identified three attack paths against Chrome's Google Password Manager cloud authenticator on Windows with TPM, all requiring pre-existing malware on the victim's device "Pass-ta-key" extracts Chrome's TPM device identity key to generate authentication assertions without user verification, exploiting a missing UV flag check that some relying parties fail to enforce "Silver Pass-ta-key" forces device re-enrollment to substitute the user-verification key with an attacker-controlled one, en
Analysis
TL;DR
- Unit 42 identified three attack paths against Chrome's Google Password Manager cloud authenticator on Windows with TPM, all requiring pre-existing malware on the victim's device
- "Pass-ta-key" extracts Chrome's TPM device identity key to generate authentication assertions without user verification, exploiting a missing UV flag check that some relying parties fail to enforce
- "Silver Pass-ta-key" forces device re-enrollment to substitute the user-verification key with an attacker-controlled one, enabling persistent access without the victim's biometric or PIN
- "Golden Pass-ta-key" extracts the 32-byte Security Domain Secret from Chrome's process memory during re-enrollment to decrypt all synced passkey private keys
- No CVEs have been assigned as of August 2026, and it remains unconfirmed whether Google or affected relying parties have fully patched all three attack vectors
Why It Matters
This research exposes critical gaps in how passkey authentication is implemented and validated across the ecosystem, demonstrating that even hardware-backed security models can be undermined through post-compromise attacks on the surrounding software infrastructure. For AI practitioners and security professionals, it highlights the importance of defense-in-depth: cryptographic guarantees alone are insufficient when the code managing key storage, re-enrollment, and user-verification checks contains exploitable weaknesses.
Technical Details
- Pass-ta-key: Malware extracts Chrome's wrapped TPM device identity key (stored without a key name to prevent disk persistence) and reuses it via Windows CNG calls to generate authentication assertions. The resulting assertions lack the User Verified (UV) flag, which relying parties like eBay initially accepted despite WebAuthn specifications requiring failure when UV is absent.
- Silver Pass-ta-key: Malware triggers Chrome device re-enrollment, exploiting a window where the user-verification key has not yet been created. The attacker registers their own key during this gap, and assertions signed with this key carry the UV flag, enabling future logins without victim interaction. Chromium source confirms a
deferred_uv_key_creationstate exists for newly registered devices. - Golden Pass-ta-key: During re-enrollment, the 32-byte Security Domain Secret (SDS) briefly exists in plaintext within Chrome's process memory. Malware reads this secret to decrypt all synchronized passkey private keys, providing reusable access from the attacker's own environment. Chromium source corroborates that SDS enters client-process data structures.
- Scope limitations: Attacks are limited to Google Password Manager in Chrome on Windows with TPM, require prior endpoint compromise, and have not been observed in the wild. Google removed an earlier SDS exposure from FIDO logs, but the secret still reaches client memory.
- No remediation confirmation: As of August 3, 2026, no CVEs exist, and searches of Google's Chrome materials and eBay's support pages found no documentation of fixes. Google's support docs allow PIN changes or data deletion but offer no SDS-specific rotation or revocation control.
Industry Insight
- Relying parties must rigorously enforce the UV flag per WebAuthn specifications; GitHub's adoption of this check demonstrates that server-side validation can neutralize Pass-ta-key attacks independently of browser fixes
- Google should implement hardware attestation verification during device re-enrollment and provide SDS-specific rotation mechanisms, as current PIN changes do not appear to revoke compromised security domain secrets
- Security researchers and practitioners should treat passkey ecosystems as only as strong as their weakest implementation layer—browser key management, re-enrollment flows, and relying party validation all require simultaneous hardening to close post-compromise attack surfaces
Disclaimer: The above content is generated by AI and is for reference only.