Unit 42 investigated how malware on a Windows PC can abuse passkey-protected accounts via Google Password Manager in Chrome. The attack is post-compromise: it only starts once the device has already been taken over.
Google is working on a Chrome feature that blocks policy extensions on unmanaged devices when they take over the New Tab page or search engine. This reduces the likelihood of hijackers by limiting the “implicit trust” in local policy keys.
Google has fixed 1,442 security bugs in recent Chrome releases, far exceeding the total of earlier updates combined. The company is also testing faster delivery, automation, and dynamic patching to reduce exposure time.
