New Chrome feature aims to stop hackers from using stolen cookies

Google is developing Device Bound Session Credentials (DBSC) for Chromium-based browsers to cryptographically bind authentication cookies to TPM-backed device keys, preventing stolen cookies from being reused to hijack accounts; the report notes that infostealer malware and operators such as Lumma and Rhadamanthys have been abusing an undocumented Google OAuth endpoint to revive or reuse stolen cookies, and that DBSC — currently prototype/testable via chrome://flags — aims to neutralize that attack vector.