Google Passkey Flaw Exposed: Malware Can Sign In Without Fingerprint or PIN

A researcher from Palo Alto Networks' Unit 42 threat research team has discovered three attack techniques that allow malware on a Windows computer to sign into accounts protected by passkeys stored in Google Password Manager inside Chrome. The attacks, known as Pass-ta-key, Silver Pass-ta-key, and Golden Pass-ta-key, require no fingerprint scan or PIN entry and can bypass security measures such as the Trusted Platform Module (TPM).

The researcher, Arie Olshtein, published a report on August 3, detailing how Chrome stores synced passkey data locally in a file path readable without elevated privileges. The stored records list every account where the victim has registered a passkey along with associated usernames and an encrypted copy of the private key.

The Pass-ta-key technique involves exporting the TPM-backed identity key as an NCRYPT_OPAQUE_KEY_BLOB, which can be extracted by malware without administrator privileges. This allows the attacker to sign authentication requests exactly as Chrome would, bypassing security measures such as user verification. The Silver Pass-ta-key technique targets accounts protected by stricter verification requirements and involves invalidating the victim's existing key and registering a new, attacker-controlled key in its place.

The Golden Pass-ta-key technique is the most severe and targets the security domain secret, a 32-byte symmetric master key that decrypts every passkey synced to a Google account. The researcher found that Chrome logs the security domain secret during registration with the cloud authenticator, making it visible to attackers.