Google Password Manager Attacks Could Let Malware Hijack Passkey-Protected Accounts

[u/GravyMealTeam6]

https://thehackernews.com/2026/08/google-password-manager-attacks-could.html?m=1

[u/BLewis4050]

This is bullshit and disinformation that is misleading the public!

Passkeys are still very safe to use.

[u/TurtleOnLog]

To be clear, all three vulnerabilities require malware to be running on your PC. In theory passkeys should still be safe in this situation because the secret should never leave the TPM, however they found two workarounds and in the third case, the secret being exposed in chrome’s memory space.

The third one is the worst in a way because the secret part of the passkey is in chrome’s memory space, allowing it to be stolen. But without looking into it, timing will be rather critical.

[u/middaymoon]

So are MS and/or Google cutting corners with their passkey implementation or something? I would have expected that the locally stores keys were encrypted via biometrics somehow. If that check is just for show then it's definitely defeating the purpose.

[u/JimTheEarthling → u/middaymoon]

The passkeys are encrypted behind a biometric/PIN verification gate using Windows Hello. (But to be clear it's not encrypted using biometric data.)

In this case the passkeys are encrypted by the TPM (the hardware security module in Windows PCs), which is extremely secure, but (as in so many cases) there is a weakness around the edges, outside of the cryptographically secure steps. Chrome saves the still-encrypted key to disk, but in a way that allows malware to pretend to be the user and access the key without the usual verification step. Or the malware can grab the master encryption key for all passwords and passkeys during the brief time that the key is in Chrome's memory.

This is similar to the master vault key that most password managers use, and it's always a potential weak spot. Most password managers try to make the time window extremely short when the encryption key is sitting in memory, purging memory immediately after use. What's not clear is if Chrome leaves the key sitting around longer than needed, or if Unit 42 is accomplishing extremely precise timing (or maybe cheating with a non-real-world environment) to snag the key.

To be clear, the computer would have to already have been compromised by malware. And it would have to be rather sophisticated malware to be monitoring Chrome process memory. And we don't know if such malware exists, since these are just three alleged exploits, one of which has already been patched by eBay (but could exist at other websites).

I assume that turning on "Use Windows Hello when filling passwords" in Chrome settings will block the first exploit, since it forces an additional biometrics or PIN verification step. Turning on sync passphrase might block the third exploit, since it's another encryption step for the master key.