Researchers Say Google Password Manager Passkeys Can Be Stolen on Windows

A malware-infected Windows PC can undermine Google Password Manager's synced passkeys, and in one case researchers said they were able to pull a secret from Chrome memory that helps protect them. On August 4, Unit 42 said it found several ways to get around passkeys stored in Chrome, including methods that could expose the key used to encrypt synchronized passkeys. The attacks require the target machine to already be compromised.

The first Pass-ta-key method, according to the researchers, exports an identity key to disk instead of keeping it in TPM, the Trusted Platform Module that would normally protect it. Unit 42 said this approach worked only on eBay because the site did not validate the user-verification flag. In other words, the attack depended not just on the infected device, but also on a missing site-side check.

The second, Silver Pass-ta-key method goes a step further. It tricks Google Password Manager into assuming the user unlocked the device with biometrics, allowing the attack to bypass another layer of protection. The third and most serious method, Golden Pass-ta-key, pulls a secret from Chrome memory that is used to encrypt synchronized passkeys.

That stolen secret is especially dangerous because researchers said it can decrypt existing and future passkeys until Google generates a new one. Google has already removed the secret from Chrome debug logs, but Unit 42 said it still appears briefly in Chrome process memory. The group also said it reached out to Google to disclose the exploits.

Even so, the researchers did not argue that passkeys are worse than passwords overall. Their conclusion was narrower: passkeys are still resistant to phishing and remain safer than traditional passwords, but cloud synchronization creates a new target on compromised devices. Unit 42 also warned that other passkey providers may face similar risks because they use the same cloud authenticator model.

How much does this change your confidence in synced passkeys on Windows?