Security researchers have found a way for malware to hijack Google’s synced passkeys within Chrome, and the flaw doesn’t require a password or fingerprint to work.
The research comes from Palo Alto Networks’ threat intelligence arm Unit 42, published on August 3, 2026. The team found three separate attack methods, all of which target the Google password manager in Chrome, specifically on Windows machines with a TPM chip.
None of these attacks break the actual cryptography behind the passkeys. That part remains intact. Instead, what they exploit is how Chrome handles device trust and stores credential data locally, a gap in the surrounding system, not the passkeys themselves.
The first method, simply called Pass-ta-key, allows the malware to silently request a valid login using the victim’s passkey, no biometric prompts, no PIN, nothing is displayed on the screen.
The second, Silver Pass-ta-key, goes a step further. The malware deletes or corrupts Chrome’s local passkey data, forcing the device to go through the re-registration process. During this window, the attacker slips in their verification key, a Google system that doesn’t check the hardware’s authenticity. Once that’s done, the attacker can log in to their machine without ever touching the victim’s device again.
The most serious is Golden Pass-ta-key. It extracts something called the Security Domain Secret, a 32-byte master key that briefly sits in Chrome’s memory. Whoever gets that key can decrypt every passkey associated with that Google account, and there’s currently no way to roll back or revoke it once it’s stolen.
All three attacks have one caveat, though. The malware must already be running on the victim’s computer. None of them work remotely against a clean, uninfected machine.
As of early August, none of the three techniques have been assigned a CVE, and Palo Alto Networks says there’s no evidence yet that the attacks are being used in the wild.
Google has removed a specific exposure that allows the security domain secret to be displayed in Chrome’s logs after Unit 42 reported it. Whether the deeper issues, which enable Silver and Golden Pass-a-Key, have been completely patched has not been publicly confirmed.
For users, the practical advice from the researchers remains simple. Keep systems updated, run active malware protection, and view unexpected files or links with suspicion, as each of these attacks originates from a device that has already been compromised.
At the time of writing, Pakistan’s National CERT had not issued a separate, dedicated advisory specifically on this Chrome Pass issue. If one is released, it would likely echo similar guidance already circulating among global cybersecurity researchers.
