Google Passkey Flaws Let Hackers Steal Secrets

Palo Alto Networks' Unit 42 found three Google passkey exploits, named Pass-ta-key, Silver Pass-ta-key, and Golden Pass-ta-key, that require prior malware infection. The methods impersonate victims or steal the master secret protecting synced passkeys. Google implemented fixes after disclosure, with some services like eBay patching vulnerabilities directly.