Google Chrome adds infostealer protection against session cookie theft

Google has rolled out Device Bound Session Credentials (DBSC) in Chrome 146 for Windows (with macOS support planned) to cryptographically bind session cookies to hardware-backed keys (TPM/Secure Enclave), preventing infostealer malware from reusing exfiltrated cookies; the protocol is privacy-preserving, developed with industry partners, and available as an open standard with implementation guidance for web developers.