Google Chrome adds session cookie theft protection for all users

Google has begun rolling out Chrome Device Bound Session Credentials (DBSC), a feature that cryptographically binds session cookies to device hardware (e.g., TPM on Windows, Secure Enclave on macOS) so stolen cookies cannot be reused to bypass MFA and hijack accounts; the feature is enabled by default for Workspace customers and widely available to users. The article notes prior abuses—undocumented OAuth MultiLogin endpoint misuse and claims by info-stealers like Lumma and Rhadamanthys—to explain the mitigation's importance, but it is an announcement of a security control rather than a report of an active incident.