Overview
- Palo Alto Networks’ Unit 42 published findings in early August 2026 describing three related attack methods called Pass‑ta‑key, Silver Pass‑ta‑key and Golden Pass‑ta‑key that target Google Password Manager in Chrome on Windows machines with a TPM.
- All three techniques require local malware on the victim’s PC and do not break passkey cryptography; they instead exploit how Chrome, the cloud authenticator and site workflows handle device identity, re‑enrollment and key provenance.
- The Pass‑ta‑key method can impersonate a trusted device to obtain a valid authentication assertion when a site fails to verify the User Verified (UV) flag, a gap Unit 42 tested successfully against eBay and which eBay has since fixed.
- The Silver method abuses re‑enrollment to register an attacker‑controlled user‑verification key that can be used from another system, and the Golden method can expose the 32‑byte Security Domain Secret (SDS) in Chrome process memory so synced passkey private keys can be decrypted.
- Google removed the SDS from Chrome’s FIDO logs and some relying parties applied fixes, but Unit 42 and reporters say the SDS still reaches Chrome memory, no public CVEs or full remediation details are posted, and defenders should harden endpoints, require and validate UV, and attestate new keys.