- Malware on a Windows PC can steal every passkey saved in Chrome's Google Password Manager.
- One attack logs in without checking a fingerprint, PIN or any screen prompt.
- A second attack lets the hacker sign in later without ever touching the victim's device.
- The worst attack copies the master key that unlocks every synced passkey at once.
- All three attacks need malware already on the machine, and no CVE has been issued.
Malware on a Windows PC can copy every passkey Chrome saved to a Google account. Palo Alto Networks' Unit 42 found three ways to attack Google's synced passkeys. The mildest one logs an attacker in with no fingerprint, no PIN and nothing on the victim's screen, on sites that skip checking a person was there. None of the three break the math that keeps passkeys secure, Unit 42 says.
Unit 42 passkey attack research
The first attack, called Pass-ta-key, uses a key Chrome stores on the victim's computer to get Google to approve a login without asking the victim anything. That approval carries a marker showing whether a fingerprint or PIN was actually checked. GitHub rejects approvals missing that marker, so the attack fails there. eBay accepted the approval anyway during testing, then fixed the check after Unit 42 reported it.
The second attack, Silver Pass-ta-key, goes further. Malware forces Chrome to set up the device again. In that window, before Chrome creates its own verification key, the attacker registers one of their own. Google's servers do not check whether that new key came from real hardware, Unit 42 says.
Google then treats any login signed with the attacker's key as proof the victim unlocked their device with a fingerprint or PIN. The attacker can then sign in from their own computer without ever touching the victim's device again.
The third attack, Golden Pass-ta-key, takes every passkey at once. One master key encrypts every passkey synced to a Google account. Chrome receives that key during the same device setup process the attacker forces. The attacker then copies the key out of the browser's memory while it briefly sits there.
Unit 42 first found this master key sitting in plain text inside Chrome's own logs. Google removed that after the report, but the key still reaches the browser during that device setup. Whether changing the account's recovery PIN cancels a key the attacker already copied is not answered in the report. Unit 42 says Google should keep this master key out of Chrome's memory and logs, and limit access to the local passkey data.
Unit 42's report lists no CVE, and a search of the National Vulnerability Database on August 3, 2026 found no entry matching the three attacks. A Palo Alto Networks researcher said Google rarely assigns a CVE to a bug that needs malware on the device. The Hacker News asked Google whether changing the Password Manager PIN cancels a stolen master key, and had not received an answer by publication.
