Palo Alto Networks Uncovers Passkey Bypass Flaws in Google Chrome

What happened

Unit 42 researchers published findings detailing three distinct attack vectors-Pass-ta-key, Silver Pass-ta-key, and Golden Pass-ta-key-that target Google Password Manager's synced passkeys in Chrome on Windows systems with a Trusted Platform Module (TPM). Each attack requires malware to already be running with user privileges on the victim's device. The basic Pass-ta-key method extracts Chrome's TPM-backed identity key and uses Windows Cryptography APIs to sign authentication requests without triggering Windows Hello or biometric prompts, though the resulting assertion leaves the User Verified flag unset. The Silver variant forces device re-enrollment and registers an attacker-controlled verification key, enabling persistent remote access with a valid UV bit. The most severe Golden Pass-ta-key attack steals the 32-byte Security Domain Secret (SDS), the master encryption key that decrypts all synced passkeys tied to an account. Researchers demonstrated they could extract the SDS from Chrome's process memory during forced re-registration, allowing them to decrypt every passkey private key and clone credentials externally. Chrome stores synced credential metadata in an unencrypted local LevelDB database, giving unprivileged malware a complete index of every service where the victim uses passkey authentication.

Why it matters

The research exposes critical implementation gaps in passkey systems that retail investors should understand as cybersecurity firms like Palo Alto Networks compete to protect the growing passwordless authentication market. While the cryptography underlying passkeys remained secure throughout Unit 42's testing, the findings reveal how device trust assumptions, onboarding procedures, and recovery flows create exploitable weaknesses. The work demonstrates that Palo Alto Networks maintains a leading research capability in identifying emerging threat vectors before they reach widespread exploitation. eBay's initial failure to validate the User Verified flag-accepting login attempts that should have been rejected-illustrates how relying parties may not properly implement passkey security, creating a market opportunity for security validation and enforcement tools. Google's removal of the SDS from Chrome's debug logs shows responsive patching, yet the master secret remains recoverable from memory with no current rotation or revocation mechanism. The absence of CVE assignments and lack of evidence of wild exploitation suggests the disclosure followed responsible channels, though the techniques could inform future malware development.

Bigger picture

The findings arrive as enterprises accelerate passwordless authentication adoption to combat phishing and credential theft. Major technology providers including Google, Apple, and Microsoft have invested heavily in passkey infrastructure following industry standards from the FIDO Alliance. However, this research highlights a persistent challenge: even advanced authentication systems remain vulnerable when the underlying endpoint is compromised. The attacks require only standard user privileges rather than privilege escalation, lowering the bar for common infostealer malware and remote access trojans. Other password manager vulnerabilities disclosed in recent months-including VaultJacking phishing methods and Chrome policy gaps-suggest ongoing pressure on credential management components. For cybersecurity vendors, the work underscores that protecting the passwordless future demands more than strong cryptography; it requires hardened implementation across device enrollment, key storage, memory handling, and relying party validation. Organizations deploying passkeys at scale face new configuration requirements around user verification enforcement and attestation checking. The research also reinforces a fundamental security principle: no authentication system can protect users when malware has already compromised a trusted device. Endpoint security remains the critical foundation, creating sustained demand for detection, response, and device trust solutions.

What to watch

Monitor whether Google releases a detailed public response confirming which attack paths remain viable in current Chrome releases and whether the company introduces an SDS rotation or revocation mechanism for compromised master secrets. Watch for updates from other browser vendors and credential managers regarding similar cloud authenticator implementations and their handling of device re-enrollment flows. Investors should track whether relying parties beyond eBay tighten user verification flag validation and attestation requirements following this disclosure. Look for enterprise adoption patterns around passkey deployment and whether organizations delay rollouts pending stronger endpoint controls. Pay attention to whether malware families begin incorporating these techniques and whether threat intelligence firms report active exploitation. Finally, observe whether this research influences WebAuthn specification updates or new platform-level restrictions on access to local passkey storage and process memory.