Comment by _23sd

The subheading "Phishing PassKeys credentials using browser intents" is inaccurate. The attacker does not get a credential, only a session.