Product

Google Password Manager

1 mentions in 7 days · 1 in 30 days · 3 total · first seen Aug 11, 2026 · last 5d ago

Timeline3 articles

Your passkeys can now move between password managers on Android

Google enabled direct password and passkey transfers between Android password managers, initiated from the destination app without unencrypted file exports.

Android now supports moving passwords and passkeys directly between password managers without exporting them to a file, replacing the previous unencrypted-export workflow. The transfer is initiated in the receiving app, which hands off to Android to detect installed managers and request authorization in the source app. The feature works today with Google Password Manager, 1Password, Bitwarden, and Dashlane, with more partners promised but unnamed. Google says data moves between apps in seconds and calls the handoff secure, without detailing the protections.

Help Net SecuritySep 10, 16:00 UTC · 5d agoTools

Google Password Manager Attacks Could Let Malware Hijack Passkey

Unit 42 details three attack paths letting Windows malware silently sign into passkey-protected accounts via Chrome's Google Password Manager without user verification.

Palo Alto Networks Unit 42 described three post-compromise attack paths—Pass-ta-key, Silver Pass-ta-key and Golden Pass-ta-key—against Chrome's Google Password Manager cloud authenticator on TPM-equipped Windows systems. The attacks can silently obtain valid authentication assertions, install attacker-controlled user-verification keys, or extract the 32-byte Security Domain Secret used to decrypt synced passkey private keys, enabling reusable access from the attacker's own environment. No CVE was assigned and no exploitation in the wild was reported; demonstrations were validated against Chrome 142 and parts of the architecture are corroborated by Chromium source. GitHub enforced the User Verified flag check, while eBay accepted a test assertion lacking it before fixing its validation gap after disclosure.

The Hacker NewsAug 11, 20:22 UTC · Aug 11, 2026Research

New Passkey Attacks Can Recover Synced Private Keys or Bypass Phishing

Three research teams showed passkey bypasses: WebAuthn assertion replay in Microsoft Entra ID, synced-passkey key recovery in Google Password Manager, and Windows Hello key reuse.

SpecterOps' Pass-the-Passkey research showed Windows stored past YubiKey signatures in cleartext and chained this with Microsoft Entra ID passkey validation weaknesses to impersonate privileged users despite phishing-resistant MFA; the Windows Event Logging Service issue is tracked as CVE-2026-34348 (CVSS 6.5) and fixed in July 2026 updates. Unit 42's Golden Pass-ta-key attack recovered the 32-byte Security Domain Secret protecting Google Password Manager synced passkeys from Chrome on Windows via pre-existing malware. Dirk-jan Mollema showed in-session malware can use a hardware-bound Windows Hello for Business key without a fresh PIN or biometric check. Microsoft applied Entra-side mitigations for the relay assertion issue; no real-world exploitation has been reported.

The Hacker NewsAug 11, 12:45 UTC · Aug 11, 2026Vulnerability CVE-2026-34348

Related CVEsby mentions

CVE-2026-343486.5<1%
Protection mechanism failure in Windows Event Logging Service allows an authorized attacker to disclose information over a network.
Protection mechanism failure in Windows Event Logging Service allows an authorized attacker to disclose information over a network.
· microsoft windows 10 1809 · microsoft windows 10 21h2—

Appears with

vendor Google 3 vendor Palo Alto Networks 2 product Chrome 2 organization Unit 42 2 product Windows Hello for Business 1 product YubiKey 1 vendor 1Password 1 vendor Bitwarden 1 vendor Dashlane 1 vendor Microsoft 1 vendor Yubico 1 victim eBay 1 organization Black Hat 1 victim GitHub 1 organization SpecterOps 1 product Android 1

Entities are extracted by the model from each article. Watching an entity keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.