Chrome Passkey Research Reveals Three Post-Compromise Attack Paths

Unit 42 has detailed three post-compromise techniques that could let malware running as an ordinary Windows user access accounts protected by passkeys synchronized through Google Password Manager in Chrome. Named Pass-ta-key, Silver Pass-ta-key and Golden Pass-ta-key, the paths can obtain a valid assertion, install an attacker-controlled user-verification key or extract the 32-byte Security Domain Secret used to decrypt synchronized passkey private keys.

The findings do not indicate a cryptographic break. Instead, they concern Chrome's handling of device keys, device re-enrollment and secrets in memory, as well as whether relying parties validate evidence that a user was verified. Every path begins after malware is already running on the victim's machine.

Three layers of the passkey workflow

Pass-ta-key extracts Chrome's wrapped device identity key and asks the same Trusted Platform Module to sign an attacker-controlled request through Windows Cryptography API: Next Generation calls. Google Cloud Authenticator then returns an assertion with the User Verified flag unset.

The Web Authentication specification requires a relying party to reject that ceremony when userVerification is set to required and the UV bit is absent. Unit 42 found that GitHub enforced this check, while eBay accepted the test assertion until it fixed the validation gap after disclosure.

Silver Pass-ta-key targets device re-enrollment. The researchers said malware can force Chrome to re-enroll and register an attacker-controlled user-verification key before Chrome creates its own. Assertions from that key carry the UV flag and could support later access from the attacker's environment. Chromium code confirms a deferred key-creation state, but does not by itself establish the reported server-side substitution against the latest stable release.

Golden Pass-ta-key targets the Security Domain Secret. Unit 42 said malware can trigger re-enrollment, capture the 32-byte secret while it briefly exists in plaintext in Chrome memory and use it to recover synchronized passkey private keys. Chromium source confirms that security-domain secrets enter client-process data structures, while reliable extraction and persistence remain claims from the research or unresolved questions.

Scope and unresolved remediation

The research is limited to Google Password Manager in Chrome on TPM-equipped Windows systems. It provides no CVE identifiers, affected Chrome versions or complete remediation status, and reports no exploitation in the wild. Chromium source as of August 3, 2026, corroborates architectural details but does not prove that the current stable release remains exploitable.

The findings add implementation-level context to Chrome fixes and the wider operational risk picture, where Chrome security fixes form part of a broader operational risk picture. In this case, the decisive controls span endpoints, credential providers and the websites accepting passkey assertions.

Unit 42 said Google removed an earlier exposure of the secret from FIDO logs and eBay now validates the UV flag. However, the secret still reaches Chrome memory, and the disclosure does not establish whether all three paths have been closed. Public documentation also does not say whether changing the Google Password Manager PIN or deleting Password Manager data invalidates a secret already held by an attacker.

What businesses should verify

Relying parties should set userVerification to required and independently check the returned UV bit. Credential providers should attest newly enrolled keys, harden re-registration and recovery, restrict access to local passkey state, and keep master secrets out of logs and memory.

For security teams, the practical implication is that passkeys do not remove the need for endpoint containment and credential-incident procedures. A compromised Windows device should trigger scrutiny of passkey enrollment, synchronized credential state and relying-party validation, especially while revocation behavior for an exposed Security Domain Secret remains undocumented.