Google Password Manager Flaw Exposes Passkey Accounts to Malware Hijacking
New security research details how malware on Windows can hijack passkey protected accounts in Google Password Manager without user interaction.
Vulnerability in the Password Manager Logic
A critical security flaw has been identified that effectively nullifies the protection provided by passkeys when stored within the Google Password Manager on Windows. Researchers discovered that malware running with standard user privileges on a Windows machine can manipulate the interaction flow between the operating system and the password manager. This allows the malicious code to authenticate into protected accounts without requiring a fingerprint, a PIN, or any other form of physical user verification.
Passkeys were designed to be the successor to the password, offering a phishing resistant way to log in using public key cryptography. By requiring local biometric or PIN confirmation, they were supposed to ensure that even if a machine was compromised, the attacker could not simply replicate the credentials. However, this new research demonstrates that if the underlying platform architecture allows for the bypass of the user interface prompt, the entire security premise falls apart. The attacker does not need to crack the encryption; they simply need to deceive the manager into believing the user has already provided authorization.
Mechanics of the Hijacking
This attack succeeds by targeting the IPC (Inter Process Communication) channels between the browser and the system security infrastructure. When a user navigates to a site and triggers a passkey request, the password manager waits for a signal that the user has verified their identity. The researchers found that by injecting a specific set of instructions into the browser's memory space or manipulating the underlying security process, the malware can intercept this signal and inject a spoofed success notification.
Because the browser trusts the password manager, and the manager trusts the operating system's security token mechanism, the entire authentication chain is subverted. The victim remains unaware that their account has been accessed, as the process happens entirely in the background without any visible prompts or error messages.
Implications for Zero Trust Architectures
This incident highlights a major flaw in the assumption that biometric or hardware security is foolproof. While passkeys remain more secure than passwords in many contexts, they are not a silver bullet against host level compromise. If an attacker has sufficient access to the local machine, they can often subvert the UI or the hooks that connect physical security to the OS.
| Defense Layer | Status | Vulnerability |
|---|---|---|
| Biometric Prompt | Bypassed | Process Hooking |
| OS Security Token | Exploited | IPC Manipulation |
| Password Manager | Compromised | Memory Injection |
The Real World Impact
For enterprise environments, this vulnerability necessitates a reevaluation of device trust. Organizations can no longer rely solely on passkeys if the devices themselves are not properly hardened and monitored. Endpoint Detection and Response (EDR) solutions will need to place a higher priority on monitoring for unauthorized attempts to interact with authentication processes and browser memory management. The industry is currently at a turning point, where the reliance on local authentication mechanisms is being challenged by the increasing sophistication of malware that operates in the gaps of modern operating systems. Securing these gaps is the next major challenge for cybersecurity professionals globally.
