Google’s Chrome 146 for Windows now includes Device Bound Session Credentials (DBSC) to defend against malware that steals session cookies.

A future Chrome update will bring this security enhancement to macOS, although the date is unknown.

Announced in 2024, this new protection utilizes cryptography to tie a user’s session to their device’s hardware, specifically the Trusted Platform Module (TPM) on Windows and the Secure Enclave on macOS.

The security chip generates unique encryption keys that cannot leave the device.

This prevents attackers from exploiting stolen session information because the private key needed to decrypt it is locked to the user’s device.

Google stated that creating new short-term session cookies requires Chrome to prove it possesses the matching private key to the server.

Without this key, any stolen session cookie is quickly rendered useless to an attacker.

A session cookie, a long-lasting authentication token generated server-side from your username and password,

is used by the server to identify you and sent to your browser for accessing online services.

Attackers use infostealer malware to steal session cookies, enabling them to authenticate to servers without needing your login details.

Google notes that infostealer malware like LummaC2 is increasingly adept at stealing these credentials, giving hackers access to user accounts.

The DBSC protocol is privacy-focused, with unique keys for each session. This stops websites from tracking user activity across multiple sessions or sites on the same device.

Furthermore, the protocol minimizes information exchange, only requiring the per-session public key for proof of possession, and avoids leaking device identifiers.

During a year of testing an early DBSC version with web platforms such as Okta, Google saw a significant reduction in session theft incidents.

Google collaborated with Microsoft on the DBSC protocol, aiming for an open web standard and incorporating feedback from web security experts.

Websites can adopt these more secure, hardware-linked sessions by adding specific registration and refresh endpoints to their backends, maintaining compatibility with existing frontends.

Web developers can consult Google’s guide for DBSC implementation details. Specifications are on the World Wide Web Consortium (W3C) website, and an explanation is on GitHub.