Chrome adopts device-bound session credentials to stop account takeovers
Original: Chrome adopts what may be the best protection yet against account takeovers
Why This Matters
DBSCs close a critical gap exploited by infostealers and AiTM phishing, representing a major shift in browser-level account security.
Google has introduced Device-Bound Session Credentials (DBSCs) in Chrome 147 for Windows and Chrome 150 for macOS. The feature stores a unique encryption key in a hardware-level secure element (TPM or Secure Enclave), preventing session cookie theft even when attackers obtain the cookie itself.
Google's Chrome browser has begun rolling out Device-Bound Session Credentials (DBSCs), a new security feature designed to counter the growing threat of session cookie theft. As two-factor authentication (2FA) and passkeys have become widespread, attackers have shifted tactics toward infostealer malware and adversary-in-the-middle (AiTM) attacks that steal session cookies — the tokens that allow users to stay logged in without re-entering credentials. DBSCs address this by binding a session cookie to a cryptographic private key stored in hardware: a TPM on Windows or a Secure Enclave on macOS and iOS. When a site sets a session cookie, the browser must sign each subsequent challenge using that hardware-resident key. Because the key cannot be extracted from the secure element, a stolen cookie alone is no longer sufficient for an attacker to hijack a session. 'The attacker can steal the cookie, but they can't answer a DBSC challenge by signing it with the private key, which is still safe on your device,' said Scott Helme, researcher and founder of Report URI. Currently, DBSCs are available in Chrome 147 for Windows and Chrome 150 for macOS, enabled only for a limited subset of users as Google appears to be conducting a staged rollout before general availability.