Researchers have uncovered a security loophole affecting Google Password Manager passkeys on Windows computers, demonstrating that malware running on an infected device can potentially bypass passkey protections according to Pcmag. Passkeys function as a password replacement based on public-key cryptography, where private keys remain on user devices and websites verify public keys and signed challenges according to Malwarebytes. While passkeys remain resistant to traditional phishing and credential stuffing attacks, researchers from Pcmag noted that vulnerabilities in the surrounding software implementation can introduce significant risks.
Understanding the Chrome Passkey Vulnerability on Windows
The research establishes that every identified attack path requires malware to be actively running as an ordinary user on a Windows machine equipped with a Trusted Platform Module according to The Hacker News. A clean, uninfected PC is not vulnerable to these techniques according to 9to5google.com. Rather than breaking underlying cryptography, the techniques target the code surrounding the passkeys, including how Chrome stores device keys, how devices re-enroll, and whether relying party websites confirm human verification according to The Hacker News.
The Three Attack Paths Identified by Unit 42
Researchers at Pcmag detailed three specific attack paths collectively referred to as Pass-ta-key according to The Hacker News:
* Pass-ta-key: Extracts Chrome’s wrapped device identity key and prompts the TPM to sign an attacker-controlled request via Windows Cryptography API: Next Generation calls according to The Hacker News, allowing malware to sign into accounts without a biometric or PIN prompt according to Malwarebytes. * Silver Pass-ta-key: Forces device re-enrollment, allowing malware to register its own user-verification key during the window before Chrome creates its official key according to The Hacker News, which can be automated easily without human intervention according to Pcmag. * Golden Pass-ta-key: Targets the 32-byte Security Domain Secret by reading the master encryption key out of Chrome’s process memory during re-enrollment according to The Hacker News, enabling the decryption of all synchronized passkeys for continued account access according to Malwarebytes.
The initial Pass-ta-key technique was found to work on eBay because the service did not validate whether a user verification process had occurred, whereas other services examined by researchers properly failed the check according to The Hacker News.
Mitigation Strategies and Recommended Best Practices
Security researchers have issued recommendations for both service developers and end users to address these endpoint and software implementation gaps. Services relying on passkeys are urged to stop blindly trusting user verification flags and properly validate that a genuine user-verified event took place before granting access according to Malwarebytes. Additionally, developers should scrutinize unusual passkey usage patterns, particularly around invalidated authentication keys according to Pcmag.
Google has been encouraged to harden device registration and recovery workflows to verify that new devices and keys are backed by genuine hardware rather than accepting them automatically according to Malwarebytes. For end users, maintaining basic anti-malware hygiene remains critical to preventing malicious software from exploiting local system environments according to Malwarebytes. Users should keep their systems and software updated, use active real-time anti-malware protection, and treat unexpected file attachments or links as suspicious according to Malwarebytes.
Worth a look