• Google adds Device Bound Session Credentials to Chrome
• DBSC ties session cookies to hardware keys, blocking theft
• Feature live on Windows, macOS rollout coming soon

Google has rolled out a new Chrome browser feature which should make stealing session cookies for use in infostealer malware attacks a thing of the past.

Chrome 146 for Windows has introduced a new security feature called Device Bound Session Credentials (DBSC), which works by cryptographically binding authentication sessions to the physical device used to authenticate.

It does so through hardware-backed security modules (such as the Trusted Platform Module on Windows) to generate a unique public/private key pair that cannot be exported from the machine.

Article continues below

Why are cookies important?

“The issuance of new short-lived session cookies is contingent upon Chrome proving possession of the corresponding private key to the server,” Google explained in its announcement. “Because attackers cannot steal this key, any exfiltrated cookies quickly expire and become useless to those attackers.”

Google says the new feature will allow websites to upgrade to secure sessions by adding dedicated registration and refresh endpoints to their backend, while maintaining compatibility with the existing front-end.

Chrome will handle cryptography and cookie rotation, while the web app will continue using standard cookies for access, just as before. Right now, the search engine giant only released an upgrade for Windows, with the macOS variant rolling out in the coming weeks.

An early version of this protocol was rolled out in 2025, Google said, noting that for sessions protected by DBSC, it observed a “significant reduction” in session theft.

Ever since multi-factor authentication (MFA) became industry standard, browser session cookies have gotten extremely valuable. Since these cookies are generated post authentication, cybercriminals can effectively bypass this important authentication step and gain access to target accounts.

Hackers usually steal these cookies by using infostealing malware, trick ingtheir targets into downloading Lumma, Vidar, StealC, AMOS, or any other variant, capable of grabbing not only session cookies, but also stored passwords, cryptocurrency wallet data, contents of the clipboard, and more.

Follow TechRadar on Google News and add us as a preferred source to get our expert news, reviews, and opinion in your feeds. Make sure to click the Follow button!

And of course you can also follow TechRadar on TikTok for news, reviews, unboxings in video form, and get regular updates from us on WhatsApp too.

Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.