Google Chrome Passkey Flaw Allows Malware to Hijack Accounts Without Multi-Factor Checks, Unit 42 Finds
Unit 42 researchers identified three attack vectors targeting Chrome's local passkey storage, allowing complete remote account takeovers.
Cybersecurity researchers at Unit 42 have discovered three critical security vulnerabilities in Google Chrome’s passkey implementation, demonstrating that malware installed on a personal computer can hijack user vaults without requiring elevated system privileges or triggering multi-factor authentication.
The findings challenge a key security promise of passwordless authentication, which major technology firms including Google, Apple Inc., and Microsoft Corp. have actively deployed to replace conventional passwords. Unit 42, the threat intelligence arm of Palo Alto Networks, disclosed that Chrome retains enough plaintext credential data in local memory and disk storage to allow attackers to fool Google’s cloud authentication servers.
Among the techniques detailed by researchers, the most severe vector allows an attacker to take over a passkey vault remotely without maintaining live access to the victim’s hardware. By deleting a specific file within Chrome’s directory structure, malware forces the cloud authenticator to re-register the device, allowing the attacker to generate a new key and access all passkey-secured accounts from an external computer.
A second attack method, termed Pass-ta-key, relies on active remote access to extract synced passkey records directly from disk or system memory. The malware mimics Google’s internal decryption process to authenticate fraudulently with cloud services. In a third scenario, attackers manipulate the browser into repeating its initial passkey setup, capturing the master key during a brief window when it is stored in system memory in plaintext.
Unit 42 confirmed that none of the three methods trigger secondary multi-factor authentication checks or require administrative privilege escalation, leaving host security software largely unaware of the compromise.
Following the discovery, Unit 42 notified Google of the flaws and urged passkey developers to restrict local file access permissions, strengthen authentication during registration, and monitor for anomalous key usage. Built on open standards established by the FIDO Alliance, passkeys rely on public-key cryptography to mitigate phishing risks, but remain susceptible when endpoint web browsers fail to isolate stored credentials in local device memory.
