Chrome Passkeys Vulnerability Lets Malware Sign In Without User Interaction

Unit42 researchers disclosed that malware running as an ordinary user on a Windows machine can sign into a victim’s passkey‑protected accounts without fingerprint, PIN, or any interaction appearing on the victim’s screen. The attack exploits three distinct paths against Chrome’s Google Password Manager cloud authenticator—named Pass-ta-key, Silver Pass-ta-key and Golden Pass-ta-key—with the strongest variant targeting the master key used for credential storage ¹.

The flaw stems from how Chrome handles authentication tokens stored locally; the master key is accessible to low‑privilege processes, allowing malicious code retrieve it without elevated rights. Unit42 highlighted that malware could use this access to authenticate with passkey‑secured services silently, effectively letting attackers sign in as the legitimate user while leaving no visible trace of biometrics or device prompts ¹.

This vulnerability echoes earlier attacks such as those against iCloud Keychain circa 2019, which also exploited weak process isolation mechanisms to let malware read stored credentials and bypass hardware‑backed authentication requirements designed to protect user data from unauthorized network connections. Such weaknesses can lead to identity theft, financial fraud, reputational damage and severe consequences requiring immediate remediation actions including software updates, enhanced threat detection capabilities and improved incident response procedures ¹.

For users and organizations alike, the discovery underscores the need for constant vigilance and adaptive defense strategies. Maintaining a robust cybersecurity posture involves promptly applying patches, monitoring suspicious local token accesses, and employing additional safeguards like multi‑factor authentication layers beyond passkeys where possible. The situation illustrates how zero‑day exploits and advanced persistent techniques continue target high‑value assets across platforms demanding proactive measures.