To counter cookie theft, Chrome ships device-bound session credentials

This article explains Google's Device Bound Session Credentials (DBSC), a W3C-standard protocol that cryptographically binds web session cookies to device-specific hardware-backed keys (TPM on Windows, Secure Enclave on macOS) to prevent cookie theft and unauthorized session renewal. It covers how DBSC works, its privacy properties, industry collaboration and origin trials, observed reductions in session theft at Google, and planned enhancements for federated identity, advanced registration, and broader device support.