The Three Techniques and What Each Exploits

Pass-ta-key (Basic)

This technique extracts Chrome's TPM-wrapped device identity key from the local passkey_enclave_state file on disk and replays it through legitimate Windows CNG API calls to sign attacker-controlled requests. This produces a valid WebAuthn assertion without any biometric or PIN prompt appearing on the victim's screen. The attack succeeds only against relying parties that do not validate the User Verified (UV) flag in the authenticator data .

Exploits: the cloud authenticator's trust in a locally stored device identity key and the absence of user-verification enforcement by some websites.

Silver Pass-ta-key

This technique defeats user-verification enforcement by deleting or invalidating the local passkey_enclave_state file, forcing Chrome to re-onboard the device. During re-onboarding, Chrome briefly creates the user verification (UV) key in a deferred flow, and the attacker registers their own UV key in that window. Google's cloud authenticator does not validate attestation on the new key, so assertions signed by it carry the UV flag set to 1, bypassing even sites that enforce user verification. The attacker gains durable, reusable access from their own machine — the victim's device no longer needs to be online .

Exploits: the absence of attestation validation during device re-onboarding and the ability to delete the enclave state file without any protections.

Golden Pass-ta-key (Critical)

This technique triggers the same re-onboarding flow, then dumps Chrome's process memory to recover the Security Domain Secret (SDS), a 32-byte symmetric key that encrypts every synced passkey in the victim's Google account. With the SDS, an attacker can decrypt all existing and future synced passkey private keys, enabling total account takeover across all services protected by those passkeys. Google had previously logged the SDS in plaintext in Chrome's chrome://device-log/FIDO output (since removed after Unit 42's disclosure), but the memory-exposure issue remains .

Exploits: the SDS being present in plaintext in Chrome's process memory during the onboarding flow.

Affected Sites

The basic Pass-ta-key attack works against any relying party that fails to validate the UV flag. Unit 42 identified eBay as one such site that did not enforce the check — eBay has since fixed it . The researchers noted that a "surprising number" of websites request userVerification: "required" at registration but never verify the returned UV bit .

Risks of a Stolen Master Key (SDS)

The SDS is a 32-byte secret that functions as the master key for all synced passkeys in the user's Google account. A stolen SDS means:

• Every existing synced passkey private key can be decrypted, and any new passkey synced afterward is also readable .
• Attackers can authenticate to any passkey-protected account — including Gmail — with no further interaction from the victim .
• Because an attacker with access to Gmail can reset passwords for downstream accounts, the blast radius extends well beyond the directly compromised services .
• There is no built-in mechanism to rotate the SDS — Google offers no way for users to generate a new one .

Recommended Mitigations

Based on Unit 42's findings and reporting from the coverage, the key mitigations are:

• Enroll at least one hardware security key (e.g., a YubiKey) alongside the synced passkey — Device-bound credentials never sync to the cloud, never enter Chrome's enclave state, and cannot be read from memory .
• Turn on Google's Advanced Protection Program for high-risk users (journalists, executives, activists, admins) — it mandates security keys or device-bound passkeys and hardens account recovery paths .
• Audit your Google account's device list monthly and remove any unrecognized sessions .
• Treat any infostealer infection as a full credential reset event — after recovery, rebuild the machine and re-register all passkeys from a clean device .
• Relying parties must validate the UV flag server-side and set userVerification to "required" (not "preferred") for sensitive operations .

Current Status

At the time of publication (August 3, 2026), no CVE had been assigned, and Google had not publicly confirmed whether the Silver or Golden paths would be directly fixed .

The Three Techniques and What Each Exploits

Pass-ta-key (Basic)

This technique extracts Chrome's TPM-wrapped device identity key from the local passkey_enclave_state file on disk and replays it through legitimate Windows CNG API calls to sign attacker-controlled requests. This produces a valid WebAuthn assertion without any biometric or PIN prompt appearing on the victim's screen. The attack succeeds only against relying parties that do not validate the User Verified (UV) flag in the authenticator data .

Exploits: the cloud authenticator's trust in a locally stored device identity key and the absence of user-verification enforcement by some websites.

Silver Pass-ta-key

This technique defeats user-verification enforcement by deleting or invalidating the local passkey_enclave_state file, forcing Chrome to re-onboard the device. During re-onboarding, Chrome briefly creates the user verification (UV) key in a deferred flow, and the attacker registers their own UV key in that window. Google's cloud authenticator does not validate attestation on the new key, so assertions signed by it carry the UV flag set to 1, bypassing even sites that enforce user verification. The attacker gains durable, reusable access from their own machine — the victim's device no longer needs to be online .

Exploits: the absence of attestation validation during device re-onboarding and the ability to delete the enclave state file without any protections.

Golden Pass-ta-key (Critical)

This technique triggers the same re-onboarding flow, then dumps Chrome's process memory to recover the Security Domain Secret (SDS), a 32-byte symmetric key that encrypts every synced passkey in the victim's Google account. With the SDS, an attacker can decrypt all existing and future synced passkey private keys, enabling total account takeover across all services protected by those passkeys. Google had previously logged the SDS in plaintext in Chrome's chrome://device-log/FIDO output (since removed after Unit 42's disclosure), but the memory-exposure issue remains .

Exploits: the SDS being present in plaintext in Chrome's process memory during the onboarding flow.

Affected Sites

The basic Pass-ta-key attack works against any relying party that fails to validate the UV flag. Unit 42 identified eBay as one such site that did not enforce the check — eBay has since fixed it . The researchers noted that a "surprising number" of websites request userVerification: "required" at registration but never verify the returned UV bit .

Risks of a Stolen Master Key (SDS)

The SDS is a 32-byte secret that functions as the master key for all synced passkeys in the user's Google account. A stolen SDS means:

• Every existing synced passkey private key can be decrypted, and any new passkey synced afterward is also readable .
• Attackers can authenticate to any passkey-protected account — including Gmail — with no further interaction from the victim .
• Because an attacker with access to Gmail can reset passwords for downstream accounts, the blast radius extends well beyond the directly compromised services .
• There is no built-in mechanism to rotate the SDS — Google offers no way for users to generate a new one .

Recommended Mitigations

Based on Unit 42's findings and reporting from the coverage, the key mitigations are:

• Enroll at least one hardware security key (e.g., a YubiKey) alongside the synced passkey — Device-bound credentials never sync to the cloud, never enter Chrome's enclave state, and cannot be read from memory .
• Turn on Google's Advanced Protection Program for high-risk users (journalists, executives, activists, admins) — it mandates security keys or device-bound passkeys and hardens account recovery paths .
• Audit your Google account's device list monthly and remove any unrecognized sessions .
• Treat any infostealer infection as a full credential reset event — after recovery, rebuild the machine and re-register all passkeys from a clean device .
• Relying parties must validate the UV flag server-side and set userVerification to "required" (not "preferred") for sensitive operations .

Current Status

At the time of publication (August 3, 2026), no CVE had been assigned, and Google had not publicly confirmed whether the Silver or Golden paths would be directly fixed .