Security researchers from Unit 42 disclose three novel attack classes against Google's synced passkey ecosystem, collectively dubbed 'Pass-ta-key' attacks. The attacks demonstrate how unprivileged malware on a compromised endpoint can exploit implementation gaps to take over passkey-protected accounts without user interaction. The Pass-ta-key attack abuses Chrome's device identity key to silently authenticate as the victim. The Silver Pass-ta-key attack registers an attacker-controlled UV key during the device re-onboarding flow, bypassing user verification entirely and enabling persistent, device-independent account access. The Golden Pass-ta-key attack extracts the security domain secret (SDS) master key from Chrome's process memory, allowing decryption of all synced passkey private keys — with no current mechanism to rotate or revoke the SDS. Key mitigations include enforcing strict UV flag validation on relying parties, validating device key attestation during registration, hardening recovery flows, and preventing sensitive key material from reaching client memory.
