Google Password Manager Flaws Let Windows Malware Hijack Passkeys via 3 Attack Paths
Updated
Updated · The Hacker News · Aug 3
Google Password Manager Flaws Let Windows Malware Hijack Passkeys via 3 Attack Paths
3 articles · Updated · The Hacker News · Aug 3
Summary
Unit 42 said malware already running as a normal Windows user can abuse Chrome’s Google Password Manager to sign into passkey accounts without a fingerprint, PIN or on-screen prompt.
Three techniques target passkey handling around the cryptography, not the cryptography itself: one reuses a TPM-backed device key, one plants an attacker-controlled verification key, and one extracts a 32-byte Security Domain Secret from Chrome memory.
The first path can be blocked if websites require and verify the WebAuthn user-verified flag; GitHub enforced that check, while eBay accepted a test assertion until fixing the gap after disclosure.
The latter two paths could give attackers reusable access from their own environment after the initial compromise, but the report cites no in-the-wild exploitation, CVEs, affected Chrome versions or confirmed remediation status.
The research is limited to Chrome on Windows systems with TPMs and highlights a post-compromise risk: users still lack clear guidance on whether changing a Password Manager PIN or deleting data revokes a stolen secret.