Research Exposes Google Passkey Exploits

Three Distinct Methods of Exploitation

Security researchers at Palo Alto Networks’ Unit 42 have identified three specific techniques capable of exploiting the Google passkey system. These methods, which researchers labeled as ‘Pass-ta-key’, ‘Silver Pass-ta-key’, and ‘Golden Pass-ta-key’, represent a tiered approach to unauthorized account access. While the exploits vary in their technical execution, they share a common dependency: each requires that the target device be compromised by malware before the attack can be initiated.

The first method involves an impersonation technique where attackers leverage existing malware to trick Google into initiating a login request as the victim. Typically, such requests necessitate authentication via a PIN or biometric verification, such as a fingerprint. In this specific scenario, the exploit successfully bypassed these standard authentication requirements. Researchers noted that this method's effectiveness depends on the specific service involved, as they were unable to replicate the attack against GitHub, though they were successful against eBay.

The Escalation of Access

The second and third techniques identified by the team demonstrate a higher level of threat. The second method centers on manipulating the trust relationship between the user’s device and Google. By coercing the system into trusting the attacker's hardware, the threat actors effectively removed the need for the victim's original computer, allowing for independent access to the account.

The most severe of the three, the ‘Golden Pass-ta-key’ exploit, targets the underlying security of the Google Password Manager sync mechanism. This system relies on a master secret to protect passkeys while they are synchronized across different devices. Researchers discovered that malware could capture this master secret while Chrome was actively using it. Once obtained, this secret allows for the wholesale decryption and theft of all synced passkeys, which can then be exfiltrated and utilized on an attacker-controlled machine.

Current Status of Security Fixes

• Three distinct passkey exploits identified by researchers.
• Attacks require prior device malware infection.
• Google has implemented fixes following the disclosure.

The research team disclosed their findings to Google prior to public release. In response, Google has initiated fixes to address the vulnerabilities, and some individual services, such as eBay, have independently patched the holes in their own systems. While progress has been made, Google has not provided an official comment to confirm that every identified flaw has been fully addressed.

Implications for Security Ecosystems

This report highlights the persistent tension between convenience and security in modern authentication frameworks. While passkeys are designed to replace traditional credentials with more robust, phishing-resistant alternatives, the reliance on browser-level sync services creates a centralized point of failure. If the underlying mechanism responsible for protecting the master secret is compromised, the security benefits of the passkey itself are effectively neutralized.

For users and businesses, this suggests that the endpoint environment remains the most critical line of defense. Because these attacks cannot manifest without an initial malware infection, traditional security hygiene—such as rigorous device monitoring and endpoint protection—remains vital. Users should remain aware that even advanced authentication protocols are not immune to attacks when the host machine's integrity has been compromised.