Google Password Manager flaw may let Windows malware access passkey-protected accounts
Researchers found that harmful software on a Windows computer can abuse Google Password Manager in Chrome to get into accounts protected by passkeys, even without a fingerprint, PIN, or visible sign-in prompt. This means passkeys may not protect you if your device is already infected.
Who is at risk
Windows users who use Chrome and Google Password Manager to sign in to accounts with passkeys are most at risk, especially if they download files or apps from untrusted sources.
What to watch for
Watch for unexpected account sign-ins, security alerts from Google or other services, and a computer that suddenly behaves strangely, runs slowly, or opens unknown programs.
What to do
Update Windows and Chrome right away, run a trusted malware scan, and avoid installing unknown software or opening suspicious downloads until your device is confirmed clean.