Malware on a Windows PC can copy every passkey that Chrome saved to your Google account. Palo Alto Networks' Unit 42 team found three ways to attack Google's synced passkeys.

You can already log into many accounts with your face, fingerprint, or a short PIN instead of typing a password.

Passkeys were supposed to end passwords for good. Just a fingerprint or a face scan, and you're in. No typing, nothing to forget, nothing to steal.