Unit 42 finds malware can extract Google's synced passkey keys straight out of Chrome's memory
Palo Alto Networks Unit 42 disclosed three attacks, Pass-ta-key, Silver Pass-ta-key, and Golden Pass-ta-key, that extract device identity keys and the master secret behind Google's synced passkeys on Windows, undermining the claim that passkey private keys cannot be copied.
Published August 3, 2026, during Black Hat USA week but as independent research rather than a conference talk, Unit 42's disclosure names three attack classes against Google's synced passkey ecosystem on Windows devices with a TPM. Pass-ta-key extracts the wrapped device identity private key from disk or Chrome's process memory and uses standard Windows cryptographic APIs to forge authentication without touching the device. Silver Pass-ta-key registers a forged user-verification key during device re-onboarding, skipping the biometric check entirely and enabling remote account takeover. Golden Pass-ta-key goes further, pulling the Security Domain Secret, the master key protecting every synced passkey on the account, out of Chrome's memory. All three require malware already present on the victim's device to start. Following responsible disclosure, Google removed the Security Domain Secret from Chrome's logging output, though researchers note it remains in process memory, and eBay independently fixed a related user-verification flag validation gap.
Why it matters
"Passkey private keys cannot be shared or copied" is the core security promise of the WebAuthn model, and this research demonstrates exactly that promise breaking down for synced passkeys specifically, where convenience (syncing a credential across your devices) trades off against the local-hardware guarantee that made passkeys phishing-resistant in the first place. This is a different attack surface than the DSInternals Pass-the-Passkey research disclosed the same week, both target passkeys, neither depends on the other.
If your organization relies on browser-synced passkeys rather than hardware-bound ones (a physical security key or platform authenticator that never leaves the device), this is the argument for reconsidering that trade-off for high-privilege accounts specifically, since all three attacks require device compromise that a hardware-bound credential would contain.
Source: Unit 42