Google Launches Device Bound Session Credentials in Chrome to Block Cookie Theft

Google said Device Bound Session Credentials (DBSC) is entering public availability for Windows users in Chrome 146, with macOS support planned for a future release. The feature is designed to blunt session hijacking by cryptographically binding a web session to a specific device, using hardware-backed security such as the TPM on Windows and the Secure Enclave on macOS.

Under DBSC, stolen session cookies cannot be reused on another system because Chrome must prove possession of a non-exportable private key before a site issues refreshed short-lived cookies. Google said an early version of the protocol has already produced a significant reduction in session theft, including attacks associated with infostealer malware such as LummaC2, and added that the privacy-preserving standard is being developed through the W3C with input from companies including Microsoft and Okta, with future work focused on federated identity, stronger registration options, and broader device support.