Protecting Cookies with Device Bound Session Credentials

Google announces Device Bound Session Credentials (DBSC) entering public availability for Windows in Chrome 146 (with macOS support coming), a protocol that uses hardware-backed keys (TPM/Secure Enclave) to cryptographically bind browser sessions to a device so exfiltrated cookies cannot be reused by attackers. DBSC preserves user privacy by issuing per-session keys without leaking device identifiers, is being standardized through W3C, and includes planned enhancements for federated identity, advanced registration, and broader device support.