Top Highlights
- Passkeys, adopting cryptographic keys for passwordless login, are trusted but vulnerable, with researchers exposing a major security flaw that allows attackers to forge their registration and bypass biometrics via malicious browser scripts and extensions.
- The security design assumes a "honest" browser; however, malicious extensions can intercept passkey workflows, rendering account access and re-registration susceptible without visible indicators or signals to users.
- Traditional security tools like EDR and SASE/SSE lack visibility within browsers, making it difficult to detect or prevent passkey exploitation, highlighting the need for browser-specific security solutions.
- With over 80% of enterprise data stored in SaaS platforms, securing browsers with specialized tools like SquareX’s Browser Detection and Response is essential to safeguard passkey use and prevent browser-based attacks.
Problem Explained
On August 28th, 2025, in Palo Alto, California, researchers from SquareX revealed a significant vulnerability in the emerging passkey authentication system at DEF CON 33. Despite being heralded as a more secure, passwordless alternative that leverages cryptographic key pairs—where private keys are stored locally on devices and only the public key resides on servers—this system has critical flaws. The researchers demonstrated that malicious scripts and browser extensions could intercept and manipulate the passkey registration and login processes, effectively allowing attackers to forge authentication, access sensitive accounts—including banking and enterprise SaaS platforms—and even cause legitimate passkey logins to fail, prompting re-registration under attacker-controlled environments. This weakness arises because passkeys depend heavily on the browser’s honesty; all communications occur through the browser, which can be manipulated without visual cues or detectable signals, leaving traditional security tools ill-equipped to detect such exploits. SquareX’s findings underscore the urgent need for specialized browser security measures—like their Browser Detection and Response solution—to prevent these vulnerabilities from undermining both consumer and enterprise security infrastructures, especially as organizations increasingly rely on passkeys for safeguarding critical data stored within SaaS applications.
Potential Risks
In August 2025, cybersecurity experts revealed a critical vulnerability in passkey-based authentication, a system designed to replace traditional passwords with cryptographic key pairs aimed at bolstering security. Despite its promise to eliminate common password-related risks, researchers demonstrated that malicious browser extensions and scripts can intercept and forge passkey registrations and authentications, effectively bypassing biometric or hardware protections. This browser-centric attack vector compromises not only consumer accounts but also high-stakes enterprise and banking systems, as conventional security tools lack the visibility to detect such sophisticated exploits within the browser environment. As passkeys rapidly become the standard for securing over 15 billion accounts—especially within SaaS platforms where most data resides—the threat underscores the urgent need for specialized browser-level security solutions, such as SquareX’s Browser Detection and Response, to prevent hijacking, unauthorized access, and data breaches driven by browser-based manipulation.
Possible Next Steps
Timely remediation in response to the "Breaking the Passkey Promise: SquareX Discloses Major Passkey Vulnerability at DEF CON 33" is crucial to prevent widespread exploitation, protect sensitive user data, and maintain trust in digital security systems.
Mitigation & Remediation Steps
- Immediate Patch Deployment: Develop and distribute security patches to address the vulnerability promptly.
- User Notification: Inform affected users about potential risks and recommend security precautions.
- Credential Reset: Enforce password or passkey resets for impacted accounts to prevent unauthorized access.
- Security Audit: Conduct comprehensive vulnerability assessments to identify and address similar issues.
- Enhanced Monitoring: Implement real-time monitoring to detect suspicious activity referencing the vulnerability.
- Access Restrictions: Limit or temporarily disable affected authentication methods until patched.
- Transparency & Communication: Maintain open communication channels with stakeholders regarding progress and updates.
- Future Prevention: Integrate rigorous security practices, such as code reviews and penetration testing, into development cycles.
Advance Your Cyber Knowledge
Discover cutting-edge developments in Emerging Tech and industry Insights.
Learn more about global cybersecurity standards through the NIST Cybersecurity Framework.
Disclaimer: The information provided may not always be accurate or up to date. Please do your own research, as the cybersecurity landscape evolves rapidly. Intended for secondary references purposes only.
Cyberattacks-V1
