Chrome Adds Device-Bound Credentials to Block Session Cookie Theft
Google's Chrome browser introduces a powerful new feature called device-bound session credentials (DBSCs) that combats a growing method of account takeover. As users adopt stronger protections like two-factor authentication and passkeys, attackers increasingly shift to stealing session cookies instead. These cookies allow websites to remember logged-in users, and criminals exploit them by swiping the cookies and pasting them into their own browsers.
DBSCs counter this threat by tying session cookies directly to the physical device running the browser. Chrome generates a unique encryption key stored inside a hardware security fortress built into the machine. On Windows computers, this is the Trusted Platform Module (TPM), while Mac devices use the secure enclave. These hardware components isolate keys so they cannot be extracted or copied by malicious software.
When a user visits a website, the browser must send a version of the session cookie signed with the locally stored key. Since attackers lack physical access to the original device, stolen cookies become useless on their own machines. The feature is now available in recently released versions of Chrome for both Windows and macOS, offering what may be the strongest defense yet against infostealer malware and adversary-in-the-middle attacks.