gbhackers.com • 3h
Google Chrome Password Manager: Passkey Theft via UV Flag Exploitation
Research from Unit 42 reveals a critical implementation flaw in how Relying Parties (RPs) validate the 'User Verified' (UV) flag within WebAuthn ceremonies, enabling malware with standard user privileges on Windows to bypass biometric and PIN requirements. By exploiting the Chrome Google Password Manager Cloud Authenticator, attackers can execute a multi-stage attack—categorized as Pass-ta-key, Silver Pass-ta-key, and Golden Pass-ta-key—to steal synced passkeys or the master key. This vulnerability degrades passkey-based multi-factor authentication (MFA) to a single-factor dependency on local host integrity, facilitating silent, non-interactive account takeovers without user interaction or physical prompts.