Google is embedding its Gemini-powered AI assistant, Spark, directly into Chrome—and handing it your saved passwords and logged-in accounts to do it. For the roughly two-thirds of Americans who use Chrome as their default browser, this isn't a convenience upgrade. It's a deeper hook into your digital life by a company that already tracks what you search, where you go, and what you buy.
Spark's new Chrome integration lets the AI assistant "use your logged-in accounts and saved passwords to handle tedious web errands," according to Engadget. Google's examples? Booking flights and scheduling apartment viewings. That's the pitch: let an AI thumb through your credential vault so you don't have to click a few buttons yourself.
The timing is uncomfortable. The same week Google touts giving an AI assistant the run of your passwords, researchers at Palo Alto Networks' Unit 42 have documented three attack paths against Chrome's Google Password Manager that can let malware silently hijack passkey-protected accounts—no fingerprint, no PIN, no prompt on your screen.
The attacks—dubbed Pass-ta-key, Silver Pass-ta-key, and Golden Pass-ta-key by Unit 42—don't break the cryptography. They go after the code around it: how Chrome stores device keys, how it re-enrolls a device after state disappears, and whether the site you're signing into actually checks that a human was verified. In one attack path, an unprivileged process can extract Chrome's wrapped device identity key and get the TPM to sign an attacker-controlled request. The only thing separating a fraudulent assertion from a real one is a single bit—the User Verified flag—which some sites don't bother checking. eBay accepted a test assertion until disclosure prompted a fix; GitHub enforced the check properly.
These are post-compromise techniques, meaning the attacker already has malware on your machine. But that's precisely the scenario that matters: if your endpoint is compromised, you'd hope your password manager isn't also a turnstile. As of August 3, no CVEs have been assigned and the National Vulnerability Database shows no matching entries.
Google, for its part, says Spark has safeguards against prompt injection—attacks where hidden prompts on malicious sites force the assistant to take unwanted actions like initiating financial transactions or exfiltrating sensitive data. But the company hasn't provided concrete details, saying only it's "investing in a layered defense that includes both deterministic and probabilistic defenses to make it difficult and costly for attackers to cause harm." Spark also won't complete payments on its own, handing the final step back to the user.
Engadget framed the Spark integration as a helpful productivity tool and noted the safety features without pressing for specifics. The Hacker News, by contrast, laid out the technical architecture of how Chrome's credential storage can be subverted—without connecting it to the new AI integration that makes those credentials more accessible than ever.
Here's the open question neither outlet grappled with: when you give an AI assistant persistent access to your password vault, you're not just streamlining your own workflow. You're expanding the attack surface for everyone who wants at that vault—including Google itself, which builds the browser, runs the AI, stores the passwords, and sets the security standards it claims will protect you. That's not a walled garden. That's a company town.
