PASSKEY LOGIN BYPASSED VIA WEBAUTHN PROCESS MANIPULATION

Summary from the TLDR InfoSec newsletter

SquareX researchers showed a passkey bypass that doesn't break cryptography but manipulates the WebAuthn flow via JavaScript injection. By tricking users into installing a malicious browser extension or exploiting site XSS, attackers can hijack registration/authentication, impersonate users, or force password fallback—even with Face ID—by forging WebAuthn API calls in the browser.