MALWARE CAN HIJACK GOOGLE'S SYNCED PASSKEYS

The vulnerabilities affect Google Password Manager's passkey synchronization feature on Windows. Attackers exploiting already-installed malware can bypass user verification, hijack passkeys stored in the cloud service, and extract the private keys used to authenticate accounts. The three discovered attack vectors target different aspects of how Google syncs and manages passkeys locally. Once compromised, attackers gain access to passkeys without requiring additional user interaction or credentials. Passkeys represent the next generation of authentication, designed to replace passwords with cryptographic key pairs. However, cloud synchronization of these keys—while improving user convenience—introduces centralized risk if the local device is compromised. Google Password Manager users on Windows should ensure their devices have active malware protection and keep systems updated. The findings highlight the critical need for endpoint security when using cloud-synced authentication methods.