Google Rolls Out DBSC in Chrome 146 to Block Session Theft on Windows

Google has made Device Bound Session Credentials (DBSC) generally available to Windows users in Chrome 146 to reduce session theft by tying short-lived session cookies to hardware-backed keys (e.g., TPM/Secure Enclave). The feature aims to render exfiltrated cookies useless to stealers (such as Atomic, Lumma, and Vidar) while providing fallbacks for devices without secure key storage and maintaining privacy by design.