According to Google, passkeys are meant to be "the simplest and most secure way to sign in to your Google account." Used by over 800 million people, they're heavily relied on as an an extra protective measure.
However, these clever replacements for traditional passwords, which use biometrics or PINs to verify your identity, may have some weaknesses.
Security researchers at Palo Alto Networks' Unit 42 revealed three attack methods that could let malware on an infected Windows PC exploit passkeys stored in Google Password Manager. The free built-in tool stores, generates and autofills passwords and passkeys across websites and mobile apps.
It's important to note that the passkeys themselves are not being hacked. Instead, the attacks take advantage of weaknesses in the way Chrome, Google Password Manager and cloud syncing work together to store and transfer your passkey data.
If successful, the attacks could allow hackers to bypass the protection provided by passkeys and potentially access accounts they are designed to protect.
Each of these techniques is dubbed "Pass-ta-key," "Silver Pass-ta-key," and "Golden Pass-ta-key."
The research team said: "Each represents a progressively more serious form of post-compromise access, ranging from silently generating a valid login response on the victim's computer to extracting passkey private keys for use on attacker-controlled systems."
So how does the first attack actually work? Malware on your PC borrows Chrome's trusted identity, which is meant to prove your device is legitimate, is used to sign a login request that Google's cloud systems accept as genuine.
The trick only succeeds when a website doesn't properly check whether the user actually verified themselves with a fingerprint or PIN before approving the login.
Unit 42 found that GitHub blocked this attack successfully, but eBay initially let it through because it wasn't validating that crucial check.
The good news? After the researchers flagged the issue, eBay patched the vulnerability. Other unnamed services were also contacted about similar gaps in their verification processes.
The second technique is a bit trickier. With Silver Pass-ta-key, malware forces Chrome to re-register the device with Google's cloud authenticator, essentially tricking the system into trusting a brand-new verification key controlled by the attacker.
This is similar to someone getting a spare key cut for your front door without you knowing.
What makes this particularly scary is that it can run entirely on autopilot — no human intervention needed. That makes it easy to bake into remote malware that quietly gets to work in the background.
However, even if you find and remove the original malware, the attacker still has access because they've already registered their own trusted key. They don't even need your device to be switched on.
Finally, the Golden Pass-ta-key attack goes after what's essentially the master key to the kingdom — a 32-byte encryption secret called the Security Domain Secret, or SDS.
This is the key Google Password Manager uses to protect all your synced passkeys across devices. The researchers found that malware could grab it by dumping Chrome's process memory during registration or recovery, when the secret is briefly exposed.
Google did remove the SDS from Chrome's log files after being told about the flaw, but Unit 42 says it's still accessible in the browser's working memory under certain conditions.
The worst part? This master key can't be replaced or revoked, meaning any future passkeys synced to your account remain just as vulnerable to decryption.
Google has started rolling out fixes, though the company hasn't yet confirmed whether every vulnerability has been fully addressed. Millions of Google Chrome users are also getting access to faster security updates soon.
