Ethical Hacking News
Google Password Manager's vulnerability could allow malware to hijack passkey-protected accounts without visible authentication. Experts recommend set userVerification to required and verify the returned UV bit, as well as strengthen re-registration and recovery checks.
Google Password Manager's cloud authenticator is vulnerable to three attack paths that can hijack passkey-protected accounts. The attacks target weaknesses in device key storage, re-enrollment processes, and the Security Domain Secret (SDS) used to decrypt synced passkey private keys. Attack paths include "Pass-ta-key," "Silver Pass-ta-key," and "Golden Pass-ta-key" that exploit vulnerabilities in Chrome's code and SDS mechanism. Experts recommend measures for mitigating these vulnerabilities, including verifying user verification settings and restricting access to local passkey state. Changing the password manager PIN or deleting data may not be sufficient to invalidate an attacker's existing secret.
The recent revelation about Google Password Manager's vulnerability has sent shockwaves throughout the cybersecurity community. A report by Unit 42, a renowned cybersecurity research firm, has exposed three attack paths that can potentially allow malware to hijack passkey-protected accounts without the need for fingerprints, PINs, or any other visible authentication mechanism.
According to the researchers, these attack paths target the code surrounding Chrome's Google Password Manager cloud authenticator, which they have dubbed "Pass-ta-key," "Silver Pass-ta-key," and "Golden Pass-ta-key." These names are derived from the fact that the attacks focus on exploiting weaknesses in the device key storage, re-enrollment processes, and the Security Domain Secret (SDS) used to decrypt synced passkey private keys.
The first attack path, dubbed "Pass-ta-key," utilizes local reconnaissance to identify the relying parties and usernames tied to the victim's passkeys. Chrome stores synchronized credential records under a specific directory, which an unprivileged process can read to gather enough metadata to launch this attack. Once this is done, malware can sign into a victim's passkey-protected accounts without any visible authentication being presented on their screen.
The second attack path, called "Silver Pass-ta-key," targets the next layer of Chrome's re-enrollment mechanism. Malware forces Chrome to re-enroll the device, which creates an opportunity for an attacker to register one of their own user-verification keys instead of a legitimate one. This method can provide reusable access from an attacker's environment after the initial endpoint compromise.
The third and most concerning attack path, "Golden Pass-ta-key," exploits vulnerabilities in Chrome's SDS mechanism. Unit 42 found that malware can trigger re-enrollment to read the Security Domain Secret out of Chrome's process memory while it is briefly sat in plaintext. This information can then be used by the attacker to recover synchronized passkey private keys.
As a result of this research, many experts are urging caution and recommending specific measures for mitigating these vulnerabilities. Relying parties should set userVerification to required and verify the returned UV bit rather than trusting the request setting alone. Credential providers should attest newly enrolled keys, strengthen re-registration and recovery checks, restrict access to local passkey state, and keep master keys out of client logs and memory.
Furthermore, changing the Google Password Manager PIN or deleting Password Manager data may not be sufficient to invalidate a secret an attacker already holds. This is what a user who suspects compromise would need in order to act. It remains unclear whether this is the case, given that there is currently no clear evidence.
In conclusion, these recent findings highlight the urgent need for increased awareness and security measures regarding password managers. With the rise of sophisticated malware attacks, it has become imperative for users to prioritize their online safety by adhering to best practices in cybersecurity.
Related Information:
https://www.ethicalhackingnews.com/articles/The-Alarming-Consequences-of-Chromes-Vulnerability-Understanding-Google-Password-Manager-Attacks-ehn.shtml
https://thehackernews.com/2026/08/google-password-manager-attacks-could.html
Published: Mon Aug 3 12:42:00 2026 by llama3.2 3B Q4_K_M
