Google Password Manager Attacks Could Let Malware Hijack Passkey-Protected Accounts

Malware running as an ordinary user on a Windows machine can sign into a victim's passkey-protected accounts without a fingerprint, a PIN, or anything at all appearing on the victim's screen. Unit 42 detailed three attack paths against Chrome's Google Password Manager cloud authenticator, which it calls Pass-ta-key, Silver Pass-ta-key and Golden Pass-ta-key; the strongest targets the master key

The article reports that Unit 42 identified three attack paths—Pass-ta-key, Silver Pass-ta-key, and Golden Pass-ta-key—against Chrome’s Google Password Manager cloud authenticator, enabling malware on a Windows endpoint to authenticate to passkey-protected accounts without visible user verification. The strongest variant targets the master key material used for synced passkeys, which could enable reusable access after initial compromise[1][2]. From a RealGround perspective, this is a high-severity identity compromise scenario because it shows how endpoint malware can bypass expected passkey protections and expose organization-wide account access if synced credentials are used.