Breaking the Passkey Promise: SquareX Discloses Major Passkey Vulnerability at DEF CON 33

According to FIDO, over 15 billion accounts have been passkey-enabled, with 69% of users globally enabling passkeys in at least one account, as the technology promotes passwordless authentication. SquareX researchers Shourya Pratap Singh, Daniel Seetoh, and Jonathan Lin disclosed a major passkey vulnerability on the main stage at DEF CON 33 that could put banking, shopping, and enterprise SaaS accounts at risk.

The authors explain that passkeys rely on a pair of cryptographic keys stored on the device and server, with authentication tied to biometrics, a hardware key, or a PIN, but SquareX demonstrated that relatively trivial scripts and malicious browser extensions can intercept and forge the passkey registration process. This can allow attackers to access accounts without the real device or biometrics and, even with registered passkeys, may force re-registration under attacker-controlled conditions.

As Vivek Ramachandran, the founder of SquareX, highlights, the browser acts as the vulnerable point, underscoring the need for browser-level security measures such as an “EDR in the browser.” The disclosure was published on 28 August 2025.