Google Rolls Out DBSC in Chrome to Prevent Session-Based Account Takeovers

Google has moved Device-Bound Session Credentials (DBSC) to general availability in Chrome for Windows, enabling cryptographic binding of session cookies to a device's secure hardware (TPM) so stolen cookies are unusable on other devices. The rollout, enabled by default for Workspace and personal accounts and integrated with Context-Aware Access and audit logs, is presented as a mitigation against session-hijacking and cookie-theft attacks that can bypass MFA; the announcement notes the gradual rollout began May 25, 2026 and requires no admin or end-user configuration.