Passkey attacks: novel bypasses against passwordless authentication

Three novel passkey attacks (Pass-ta-key, Silver, Golden) against Google's synced passkey ecosystem on Chrome/Windows allow malware to silently authenticate without user interaction, bypassing biometrics. Pass-ta-key details: malware hijacks passkey sessions. Golden attack exposes encryption keys that cannot be rotated. Challenges passwordless security as passkeys scale. No CVEs yet but architectural exposure significant. Confirmed by multiple articles.