Affected Systems

Google Password Manager synced passkeys on Chrome for Windows with TPM. All three attacks require pre-existing malware on the victim's Windows device. Services that do not properly validate user verification flags (e.g., eBay, now patched) are vulnerable to account takeover. Golden Pass-ta-key exposes all synced passkeys via master key extraction from Chrome memory.

Exploitation Status

Proof-of-concept demonstrated by Palo Alto Networks Unit 42. Successfully tested against eBay (now patched). No evidence of active in-the-wild exploitation reported. Requires pre-existing malware with unprivileged access on victim's Windows device.

Business Impact

Organizations using Google Password Manager passkeys on Windows face account takeover risk if endpoints are compromised. Pass-ta-key bypasses user verification for services that do not validate flags properly. Silver Pass-ta-key registers attacker-controlled verification keys, enabling persistent access. Golden Pass-ta-key extracts master keys from Chrome memory, decrypting all synced passkeys—current and future—with no rotation mechanism available. GitHub validated correctly and blocked the attack; eBay did not but has since patched. Google removed secrets from FIDO logs but master key remains in process memory. No CVE assigned yet.

Urgency

🟡 Within a week

Recommended Actions

  • Audit web applications and services to ensure user verification flags in WebAuthn assertions are properly validated server-side, not just requested.
  • Deploy endpoint detection and response (EDR) tools to monitor for Chrome process memory access, TPM key abuse, and forced Chrome re-registration events on Windows devices.
  • Educate users relying on Google Password Manager passkeys that device compromise negates passkey protections; prioritize endpoint hardening and malware prevention.
  • For high-risk accounts, prefer hardware security keys (e.g., YubiKey) over synced passkeys, as they do not expose private keys or master secrets to the host system.
  • Monitor Google's security advisories for patches addressing TPM device identity validation, cloud authenticator key registration hardening, and master key exposure in Chrome memory.