Comment by _23sd

I only felt the need to leave a grumpy comment because of the word “credential”, so deleting it might help even if it leaves ambiguity. Otherwise maybe something like “attacker in the middle any site’s passkey authentication using browser intents” sounds more accurate.