Google Chrome Rolls Out Protection Against Infostealers Targeting Session Cookies

Google announced Device Bound Session Credentials (DBSC), a Chrome feature that cryptographically ties authentication sessions to device-specific hardware-backed key pairs (e.g., TPM on Windows, Secure Enclave on macOS) to prevent infostealers from reusing exfiltrated cookies. DBSC is available on Chrome 146 for Windows with macOS support planned, aims to reduce session theft while preserving compatibility and privacy, and is being developed as an open W3C-vetted standard.