Google Chrome Memory Management Flaw Lets Hackers Steal Passkeys to Control Online Accounts

A security vulnerability in Chrome browser's memory management mechanism allows hackers to directly extract and steal Passkey credentials from memory, thereby taking control of victims' online accounts. A prerequisite for carrying out such attacks is that the victim's PC has already been injected with malware.

There are three attack methods. The first, known as "Pass-ta-key," requires the attacker to have real-time remote access to the target device. By reading synced key records from disk or memory, the attacker simulates the decryption process to deceive the cloud verifier. The second method deletes specific internal Chrome files, forcing the cloud to re-authenticate and issue new keys, allowing the attacker to take over the account without real-time remote control. The third method targets the initial binding stage, inducing the browser to re-run the Passkey registration process and intercepting the master key during the brief moment it appears in plaintext.

None of the above attack methods require system privilege escalation, nor do they trigger multi-factor authentication. The vulnerability information has been reported to Google.