Google Password Manager Attacks Could Let Malware Hijack Passkey-Protected Accounts

Summary: Unit 42 detailed three attack paths against Chrome's Google Password Manager cloud authenticator on Windows systems with a TPM, named Pass-ta-key, Silver Pass-ta-key and Golden Pass-ta-key, which can obtain a valid authentication assertion, install an attacker-controlled user-verification key, or extract the 32-byte Security Domain Secret used to decrypt synced passkey private keys. The attacks do not break the cryptography and every path begins with malware already running on the victim's device; the report gives no CVE identifiers, and a National Vulnerability Database search on August 3, 2026 found none matching the three techniques.
Bottom line: Arie Olshtein of Palo Alto Networks said the demonstrations were validated against Chrome 142 and, apart from a logging issue, still worked against the current stable version, while the disclosure does not establish whether all three paths have been closed. The reviewed sources also do not say whether changing the Google Password Manager PIN or deleting Password Manager data invalidates a secret an attacker already holds, which is what a user who suspects compromise would need to act.

Read the original at The Hacker News ↗

Topics: Zero-Days & Exploits
Related: New Sign Drop Exploit Can Abuse Windows Defender to Bypass Security Protections Cyber Risks · Nov 13, 2026
New Sign Drop Zero-Day Exploit Turns Windows CLFS Security Feature Into SYSTEM Access Cyber Risks · Nov 12, 2026
November Patch Tuesday: An Overflowing Cornucopia of CVEs Cyber Risks · Nov 10, 2026