Researchers at Unit 42 have uncovered three distinct attack vectors targeting the Google Password Manager within the Chrome browser. These vulnerabilities, which security analysts have categorized as 'Pass-ta-key,' 'Silver Pass-ta-key,' and 'Golden Pass-ta-key,' could allow malicious software running on a compromised Windows machine to access accounts protected by passkeys. According to The Hacker News, the most severe of these methods targets the primary master key, potentially granting attackers full access to sensitive user data without triggering any standard security prompts or verification requests.

Under normal conditions, passkeys are designed to replace passwords by requiring user interaction, such as biometric verification or a PIN. However, these specific flaws allow malware to intercept or manipulate the authentication process silently. By operating at the user level on a Windows environment, the unauthorized software can effectively bypass the intended user-presence checks. This means that victims may remain entirely unaware that their authentication tokens have been accessed or utilized by unauthorized third parties.

The findings highlight a significant evolution in malware tactics aimed at modern browser-based security features. While passkeys were intended to harden account protection, these discovered weaknesses illustrate that the underlying cloud-based authentication flow is susceptible to exploitation if an attacker successfully infiltrates the host operating system. As browsers continue to integrate deeper security features into their password managers, security professionals emphasize the need for continued vigilance regarding endpoint protection and the mitigation of malware that can operate in the background.