Improving the security of Chrome cookies on Windows

Google’s Chrome Security Team announced App-Bound Encryption in Chrome 127 for Windows, binding sensitive data (starting with cookies) to Chrome’s application identity to thwart infostealer malware that abuses DPAPI. The feature raises attacker cost by requiring elevation or code injection, complements existing protections and event logging (Event ID 257), and includes enterprise guidance around roaming profiles and policy controls.