Google Password Manager Attacks Could Let Malware Hijack Passkey-Protected Accounts

According to reports from LinkedIn and thehackernews.com, the vulnerability allows malware to access the synchronized passkey data stored in the manager without requiring the user’s password or fingerprint. The exploit is framed as a direct route for attackers to compromise passwordless authentication mechanisms that rely on Google’s cloud‑based sync. CyberSecurityNews and Unit 42 both emphasize that the attack bypasses traditional credential checks, noting that the malware can steal a Google‑synced passkey without prompting the user for any authentication factor. Unit 42’s analysis, titled “Pass the Passkey: A Novel Attack Surface in Passwordless Authentication,” labels the method as a new vector against passwordless login flows.

Passkeys, introduced as a replacement for passwords, are stored locally on devices and optionally synchronized through Google Password Manager to simplify cross‑device login. The design assumes that synchronization is protected by the user’s primary credentials and biometric locks, making the stored keys resistant to theft. The reported exploit challenges that assumption by demonstrating that compromised software can retrieve the synchronized token directly from the manager, potentially exposing any account that relies on the passkey for authentication. Observers are advised to monitor Google for forthcoming security patches or configuration changes that address the reported flaw.

Unit 42’s ongoing analysis may provide mitigation guidance, while industry outlets are likely to track any official response from Google. Users of Google Password Manager may watch for recommendations on disabling passkey sync or adopting hardware security keys as interim safeguards.