[_23sd]

I only felt the need to leave a grumpy comment because of the word “credential”, so deleting it might help even if it leaves ambiguity. Otherwise maybe something like “attacker in the middle any site’s passkey authentication using browser intents” sounds more accurate.

[mastersplinter]

will think about this and try to find a good subtitle, thanks :)