Google Password Manager and passkeys: what the Unit 42 attacks change (2026)

Unit 42 disclosed three attacks against passkeys synced through Google Password Manager, and the coverage has been blunt enough to worry anyone who moved their accounts to passkeys on the promise that they were the safe option. What those attacks actually broke, and what they left standing, is unpacked in are passkeys safe after Pass-ta-key. The most alarming of the three extracts all of your synced passkeys at once.

Before changing anything, it is worth being precise about what was broken, because the answer decides whether switching password managers helps you at all. It does not, and this page explains why.

What the research actually shows

The three attacks share one mechanism. On a Windows machine that is already compromised, malware extracts the identity key and then uses standard Windows cryptography APIs to sign authentication requests the same way Chrome would. Nothing is cracked. The attacker borrows a trust relationship the PC had already established.

• Pass-ta-key takes over an account protected by a Google-synced passkey, with no privilege escalation and no interaction from you.
• Silver Pass-ta-key deceives Google's cloud authenticator into believing the device was unlocked with biometrics.
• Golden Pass-ta-key is the broadest: it extracts every synced passkey, in a form that can be shared or sold.

Google was notified, and the weaknesses lie in how Chrome and the cloud authenticator handle device trust, onboarding, recovery and synced credentials. Those fixes arrive through updates you have to install.

The part most articles skip: does another manager help?

This is the question this site exists to answer, and the honest answer is uncomfortable: moving your passkeys to a different password manager does not protect you from this.

Malware running under your user account inherits what your account can do. It can read what your session can read. A third-party vault sitting unlocked on that same desktop is reachable by the same code, through different plumbing. Swapping vaults changes which software holds the credential, not the fact that hostile code is executing as you.

We could tell you otherwise. A migration guide with an affiliate link at the end would convert better than this paragraph. But a recommendation that does not survive contact with the threat model is worth nothing, and you would find out the hard way.

There are good reasons to prefer a dedicated manager over the browser's built-in one: portability between ecosystems, controlled sharing, not being tied to a single browser, and clearer export paths. Immunity to a compromised machine is not on that list.

What does change the outcome

A hardware security key. On a FIDO2 key, the private key is generated inside the token and never leaves it. Software on the computer can ask the key to sign a challenge; it cannot copy the key out. That is a structural property of the device, not a configuration you can get wrong.

This is precisely why the attacks above target synced passkeys. Syncing is a genuine convenience, and it is also, by design, a credential that exists in more than one place and can be restored to a new device. Anything that can be restored can, in principle, be exfiltrated by code with enough access.

If you want the comparison in detail, our guides on Token2 versus YubiKey, Nitrokey versus YubiKey and keeping a second security key as backup cover the practical trade-offs, including cost.

What to do this week

Confirm the machine is clean. Every attack here assumes malware is already resident. Unexplained slowdowns, browser settings that changed by themselves, security tools that stopped updating: treat a scan as the first step, not the last.

Install the updates. Chrome and Windows updates are how the vendor fixes reach you. Postponing them is the one decision that keeps you exposed to a known and now public weakness.

Put a hardware key on the accounts that matter. Email first, because it is the recovery path for everything else. You do not need one for every account; you need one where account takeover would cascade.

Do not panic-migrate. It is effort that feels like progress and changes nothing about this threat.

What to remember

Passkeys still do what they were built to do: they defeat phishing and credential reuse, and no fake login page can capture something reusable. What this research punctures is a broader claim they were never able to make, which is that a credential can stay safe on a machine that is not.