Google has released Device Bound Session Credentials (DBSC) to all Chrome for Windows users, following its beta testing.

Currently, only Windows Chrome 146 users have access, but macOS support is coming in a future version.

Google’s Chrome and Account Security teams stated that this is a major advancement in fighting session hijacking, “a persistent problem in today’s security landscape”, according to a Thursday announcement.

Session theft involves secretly stealing session cookies from browsers, either by finding existing ones or waiting for users to log in, and sending them to a malicious server.

This often occurs when users accidentally download malware that steals information. These types of malware, like Atomic, Lumma, and Vidar Stealer, can collect various types of data from infected systems, including cookies.

Because session cookies often last a long time, attackers can use them to access victim’s accounts without needing passwords. The stolen cookies are then sold to other cybercriminals who can launch their own attacks.

DBSC, which Google announced in April 2024, is designed to combat this issue by cryptographically linking the login session to a specific device. The goal is to make stolen cookies useless, even if malware steals them.

Google explained that it does this using hardware security modules like TPM on Windows and Secure Enclave on macOS, to create a unique key pair that cannot be copied off the machine.

“To get new session cookies, Chrome must prove it has the corresponding private key to the server. Because attackers can’t steal this key, any copied cookies quickly become invalid.”

According to Google’s developer documentation, DBSC will automatically revert to standard behavior if a device doesn’t have secure key storage, without disrupting the login process, they stated.

The company reports a noticeable drop in session compromise since the launch, indicating that this new measure is effective. Google plans to expand DBSC to more devices and integrate advanced features for enterprise users.

Google, in collaboration with Microsoft, designed the standard with the goal of making it an open web standard. They also emphasized that DBSC is designed with privacy in mind, and the unique key ensures that websites cannot track a user’s activity across different sessions or sites on the same device.

“The protocol is designed to be lightweight: it doesn’t send device identifiers or attestation data to the server, beyond the public key needed to verify proof of possession,” they added. “This limited information exchange ensures DBSC secures sessions without enabling cross-site tracking or acting as a device fingerprinting tool.”