Breaking the Passkey Promise: SquareX Discloses Major Passkey Vulnerability at DEF CON 33

According to CyberNewsWire, SquareX researchers Shourya Pratap Singh, Daniel Seetoh and Jonathan Lin disclosed a major passkey vulnerability on DEF CON 33 main stage that could put banking, shopping, and enterprise SaaS accounts at risk. The piece explains that passkeys rely on a cryptographic key pair, with the private key stored on the user’s device and the public key on the server, and that authentication occurs when the user proves possession of the private key via biometrics, a hardware key or a PIN.

It notes that all communication between server and device runs through the browser, which SquaresX demonstrated can be intercepted or forged through simple scripts and malicious extensions, enabling access without the real device or biometrics. The researchers warned that even registered passkeys can be forced to fail, prompting re-registration under an attacker‑controlled environment.

The article quotes SquareX founder Vivek Ramachandran and highlights that browser security is the critical weak point, calling for a browser security layer or “EDR in the browser.” It also mentions that passkeys are becoming dominant as over 80% of enterprise data resides in SaaS, underscoring the urgency for robust browser protection.