Google Unveils Device-Bound Chrome Sessions in Anti-Cookie-Theft Move

Google announced the public rollout of Device Bound Session Credentials (DBSC) for Windows in Chrome 146, a hardware-backed mechanism (TPM/Secure Enclave) that ties authentication sessions to a device-specific private key to prevent session hijacking via stolen cookies. The article outlines how DBSC mitigates the threat of cookie exfiltration by infostealing malware (e.g., LummaC2), describes privacy protections and cross-vendor development, and notes planned expansion to macOS and enterprise SSO scenarios.