Hardware-Locked: How Chrome’s New DBSC Makes Stolen Cookies Worthless

Google has made Device Bound Session Credentials (DBSC) publicly available starting with Chrome 146 on Windows; DBSC cryptographically binds session credentials to a device's secure hardware (TPM/Secure Enclave) so exfiltrated session cookies are unusable on other machines, aiming to mitigate session hijacking by infostealers such as LummaC2 while preserving privacy via per-session keys.