Passkeys Bypassed Without Breaking Cryptography: Three Techniques Target Windows, Chrome, and Entra ID

The news, reported on August 10, 2026, concerns three independent research efforts showing how passkey protections can be bypassed without breaking FIDO cryptography.

The attacks do not directly recover private keys from authenticators. Instead, they reuse previously generated signatures, exploit synchronization, or use keys available within already compromised Windows sessions.

The SpecterOps Chain Across Windows and Entra ID

On August 5, 2026, Michael Grafnetter, principal security researcher at SpecterOps, presented the “Pass-the-Passkey” technique at Black Hat USA 2026.

The attack chain involves Windows 10, Windows 11, Windows Server, the Windows Event Logging Service, and Microsoft Entra ID. According to SpecterOps, Windows stored signatures previously generated by a YubiKey in plaintext, making them readable even to authenticated unprivileged users, including remote users.

An attacker could combine these signatures with weaknesses in Entra ID’s validation of passkey relay assertions. The result was authentication as a privileged user, even with phishing-resistant MFA.

The YubiKey’s private key was not extracted. Instead, previously signed cryptographic material was reused.

The associated vulnerability is CVE-2026-34348, which Microsoft rated CVSS 6.5. Microsoft has released a security update. The affected products include Windows 10, Windows 11, and Windows Server, but this does not establish that the entire attack chain works in the same way across every release.

Google Password Manager and Chrome Become Malware Targets

Unit 42 described three attack paths known as “Pass-ta-key.” All require malware to be running on the endpoint, but do not require administrative privileges.

The first abuses the device identity mechanisms used by Chrome to make the malware appear to be a legitimate Google Password Manager client. This allows it to obtain signatures and authenticate without requiring a new device unlock or user interaction.

The technique was demonstrated against eBay, even when the site required user verification. Following the disclosure, eBay changed its validation of the WebAuthn user verification flag.

The more serious variant, called Golden Pass-ta-key, targets the Security Domain Secret, a 32-byte master key protecting synced passkeys. Unit 42 says the secret was exposed in Chrome device diagnostic logs.

Google removed it from the logs. According to Unit 42, however, it remains temporarily in Chrome process memory during re-registration. No specific affected Chrome version has been identified.

Windows Hello for Business Can Also Be Reused

Dirk-jan Mollema demonstrated another scenario: malware running in an already authenticated Windows session can use a Windows Hello for Business key associated with the hardware without requiring the PIN or biometric verification again.

The issue does not involve bypassing biometric protection or deriving the private key. The compromised session already has the context required to use the key.

This reduces the value of requiring a new local verification when the endpoint is already under an attacker’s control.

What Administrators and Users Should Do

• Install Microsoft’s update addressing CVE-2026-34348.
• Update Chrome and, where possible, limit the collection of sensitive diagnostic logs.
• Keep endpoint protections and phishing-resistant authentication enabled.
• Apply the principle of least privilege and a Zero Trust model.
• Monitor for anomalous access to Entra ID, Google Password Manager, and privileged accounts.
• Treat a Windows session as compromised if the device is running malware.

Microsoft also says it has introduced mitigations for the passkey relay assertions issue, but has not provided technical details about the scope of the protections on the Entra ID side.

Synced or device-bound passkeys improve protection against phishing, but they do not eliminate the risk posed by a compromised endpoint or an already compromised session.