Chrome Passkey Theft Possible Without User Prompt, Research Shows
This digest was compiled by AI from multiple sources — links to the originals are below.
Palo Alto Networks Unit 42 released a technical analysis on August 3 detailing three methods that let malware on a compromised Windows machine silently steal and reuse passkeys from Chrome’s Google Password Manager. The Pass-ta-key, Silver Pass-ta-key, and Golden Pass-ta-key techniques exploit gaps in how Chrome stores device keys and handles re-enrollment, enabling attackers to obtain valid authentication assertions without triggering a fingerprint or PIN prompt. The research noted that none of the attacks break passkey cryptography, highlighting implementation flaws rather than protocol weaknesses.
Attack Techniques
Unit 42 identified three distinct chains. Pass-ta-key extracts Chrome’s wrapped device identity key and uses the Windows CNG API to have the TPM sign an attacker-controlled request, producing a valid authentication assertion with the User Verified flag unset. Silver Pass-ta-key re-enrolls a new user-verification key by simulating a device state loss, allowing the attacker to register their own biometric or PIN method. Golden Pass-ta-key decrypts synced passkey private keys by extracting the 32-byte Security Domain Secret from Chrome’s local storage. All three start with malware already executing on the victim’s machine and require only user-level privileges.
Post-Compromise Risks
The techniques do not describe an initial infection vector but illustrate what an attacker can achieve once inside. The researchers noted that the UV flag being unset in Pass-ta-key means relying parties that fail to check it would accept the assertion as legitimate. Silver and Golden attacks provide reusable access, enabling the attacker to authenticate from their own environment independently. Chrome stores credential records in a LevelDB database under the profile’s Sync Data folder, accessible to unprivileged processes, which facilitates reconnaissance of relying party IDs and usernames. No exploitation in the wild has been reported, and no CVE identifiers had been assigned as of publication.
What's Next
Unit 42 recommends that service providers verify the UV flag during authentication and that Google label TPM keys to prevent reuse. It remains unclear whether the latest stable Chrome release addresses these issues, and no official patch timeline has been announced.
2 sources
Chrome Passkey Theft Possible Without User Prompt, Research Shows
