Google Passkey Master Key Leaks to Chrome Memory and Cannot Be Revoked

What it is about

Who published it, and when

How it spread - 2 original reports

1. Wed, 5 August 2026

   1 report
   • techtimes.com13:00first to report
     Google Passkey Master Key Leaks to Chrome Memory and Cannot Be Revoked

     Google passkey security vulnerability: Unit 42 finds Chrome exposes a 32-byte master key in plaintext memory during re-registration. Google has no mechanism to rotate or revoke this Security Domain Secret, meaning malware that captures it permanently controls every passkey in a victim’s Google

2. Tue, 11 August 2026

   1 report
   • Google News - Top Stories11:30
     Here's why the new Pass-ta-key attack is mostly a nothingburger

     Here's why the new Pass-ta-key attack is mostly a nothingburger Ars Technica New Passkey Attacks Can Recover Synced Private Keys or Bypass Phishing-Resistant MFA The Hacker News Pass the Passkey: A Novel Attack Surface in Passwordless Authentication Unit 42 Google’s synchronized passkeys can be stolen in ‘Pass‑ta‑key’ attacks Malwarebytes Microsoft Leaves Windows Passkey Prompt Spoofing Unfixed cyberkendra.com