Unit 42 Finds 3 Attacks on Google Synced Passkeys
08 Aug 2026
Passwordless authentication has been pitched as the fix for credential theft, phishing, and password reuse. New research from Palo Alto Networks' Unit 42 complicates that pitch: synced passkeys, when combined with malware already sitting on a device, may not be as bulletproof as assumed.
What was found
Unit 42 disclosed three novel attacks — dubbed Pass-ta-key, Silver Pass-ta-key, and Golden Pass-ta-key — targeting Google's synced passkey ecosystem. The research focused specifically on Google Password Manager in Chrome on Windows, on devices equipped with a Trusted Platform Module (TPM).
All three attacks share one precondition: malware must already exist on the victim's device. From there, the attacks escalate in severity:
- Pass-ta-key: Enables account takeover using device malware — without privilege escalation, device unlock, or any user interaction.
- Silver Pass-ta-key: Deceives the Google Cloud Authenticator into falsely believing the victim has unlocked the device via biometrics, enabling full account takeover without the attacker ever touching the victim's device during authentication.
- Golden Pass-ta-key: Goes further, extracting all synced passkeys in a form that could be shared or sold on the credential black market.
Unit 42 notes that Chrome locally stores synced passkey data in proto-encoded WebauthnCredentialSpecifics records, which can be accessed without elevated privileges — a key enabler for these attacks.
Why this matters
The core risk: malware already present on a device can bypass user verification and take over passkey-protected accounts without any user interaction. That undermines one of the main selling points of passwordless authentication — that it removes the human as the weak link. Instead, these attacks show that onboarding, recovery, and device-trust workflows can be misused by malware to hijack accounts, and that private keys for synced passkeys can potentially be extracted and monetized on black markets.
Sources differ / gaps in the record
Several important details are missing from the disclosure as reported:
- No timeline is given for when the research was conducted or disclosed to Google, and no mention of whether a patch or mitigation has shipped.
- It's unclear how common the required initial malware infection actually is in real-world attack scenarios.
- The report does not say whether other browsers, operating systems, or passkey providers (e.g., Apple, Microsoft) share similar exposure.
- No CVE identifiers or severity ratings were included.
- No data on real-world exploitation or public proof-of-concept availability beyond the described attack mechanics.
Why founders should care
For founders building or relying on authentication infrastructure, this disclosure likely raises more questions than it answers — but the questions are worth asking now rather than after an incident.
- If your product integrates Google Password Manager or similar synced passkey systems, it's plausible your exposure to malware-based attack vectors deserves review before further scaling authentication features.
- The findings suggest that trust assumptions baked into device-based authentication — like treating biometric confirmation as proof of physical possession — may need additional verification layers to hold up under malware conditions.
- There's a reasonable chance this disclosure creates near-term demand for endpoint malware detection tools purpose-built for passkey environments, as well as TPM-based security enhancements or local storage encryption for synced credentials.
- Startups in the credential-management or authentication space could differentiate by hardening onboarding, recovery, and device-trust workflows specifically against the attack patterns described here — a gap the research suggests is currently underserved.
Because so much context (patch status, scope beyond Google, real-world prevalence) is still unknown, founders should treat this as an early signal rather than a fully mapped threat — but one that merits a security audit of any passkey-dependent product roadmap.