Security researchers have discovered a series of attacks that can allow malware on a compromised Windows computer to hijack Google's synced passkeys, potentially giving attackers access to a user's online accounts without triggering standard biometric or PIN verification.