Research from Unit 42 reveals a critical implementation flaw in how Relying Parties (RPs) validate the 'User Verified' (UV) flag within WebAuthn ceremonies, enabling malware with standard user privileges on Windows to bypass biometric and PIN requirements. By exploiting the Chrome Google Password Manager Cloud Authenticator, attackers can execute a multi-stage attack—categorized as Pass-ta-key, Silver Pass-ta-key, and Golden Pass-ta-key—to steal synced passkeys or the master key. This vulnerability degrades passkey-based multi-factor authentication (MFA) to a single-factor dependency on local host integrity, facilitating silent, non-interactive account takeovers without user interaction or physical prompts.

• Vulnerability Overview: Implementation Gaps

  • Focuses on the discrepancy between FIDO/WebAuthn standards and the actual validation logic used by Relying Parties (websites/services).
  • Targets the Chrome Google Password Manager's cloud synchronization mechanism on Windows systems.
  • Allows malware operating with ordinary user privileges to trigger authentication ceremonies without requiring administrative rights.

• Technical Attack Mechanics: Escalation Tiers

  • Pass-ta-key: The initial stage exploiting RPs that fail to verify the UV flag, allowing authentication without the mandatory biometric or PIN check.
  • Silver Pass-ta-key: An intermediate path that targets the synchronization layer to access specific synced credentials stored in the cloud.
  • Golden Pass-ta-key: The highest criticality tier involving the theft of the master key, granting the attacker full access to the synced passkey vault.

• Security Impact: MFA Degradation

  • Single-Factor Reduction: Effectively converts a hardware-backed MFA process into a single-factor dependency based solely on machine possession.
  • Silent Execution: Enables account access in the background, removing the need for screen-based prompts or physical user interaction.
  • Ecosystem Risk: Undermines the security premise of cloud-synchronized credential ecosystems by creating a single point of failure at the host level.

• Defensive Measures & Mitigation

  • RP Enforcement: Relying Parties must strictly validate the 'User Verified' (UV) flag in WebAuthn responses to ensure local verification occurred.
  • Endpoint Monitoring: Deployment of EDR/XDR to detect unauthorized processes interacting with the Chrome Password Manager's local storage and API.
  • Hardware Anchors: Transitioning high-value accounts to dedicated hardware security keys (e.g., YubiKey) that enforce verification independently of the OS.

• Conclusion: Systemic Trust Risks

  • Demonstrates that "passwordless" authentication is only as secure as the local trust anchor and the RP's adherence to protocol specifications.
  • Highlights the systemic risk introduced when cloud synchronization prioritizes convenience over strict cryptographic verification.