Pass-ta-key steals Google's synced passkeys and the master key can't be revoked

Unit 42's three Pass-ta-key attacks need malware already on Windows, no admin rights. The SDS master key sits in Chrome memory in plaintext, with no way to rotate it.