Pass the Passkey: A Novel Attack Surface in Passwordless Authentication

This report demonstrates three novel attack classes against Google’s synced passkey implementation in Chrome on Windows: (1) Pass-ta-key — malware on a compromised endpoint uses the device identity key to silently obtain valid authentication assertions and perform account takeover without user interaction; (2) Silver Pass-ta-key — attackers invalidate and re-register user-verification (UV) keys to obtain assertions with the UV flag set, bypassing biometric/PIN requirements and enabling remote reuse; and (3) Golden Pass-ta-key — attackers extract the security domain secret (SDS) during device re-onboarding to decrypt all synced passkeys, enabling wholesale credential exfiltration and long-term persistence. The report provides technical details of the flows, root causes in onboarding/recovery and logging/memory exposure, and mitigation recommendations for relying parties and credential manager vendors.