Chrome adopts what may be the best protection yet against account takeovers
| Source: Ars Technica AI
Tags: Chrome, DBSC, session security, cookie theft, TPM, browser security, Google
Chrome 147+ for Windows and 150+ for macOS now binds session cookies to the device's TPM or secure enclave, making stolen cookies useless without the physical hardware — directly countering the surge in infostealer malware that exploits post-2FA session hijacking.
Details
Google Chrome has added device-bound session credentials (DBSCs) in versions 147 (Windows) and 150 (macOS), addressing a growing attack vector: session cookie theft by infostealer malware or adversary-in-the-middle proxies.\n\nThe protection works by generating a cryptographic key stored in the device's hardware security chip — TPM on Windows, Secure Enclave on macOS and iOS. When a site sets a session cookie, subsequent requests must be signed with this hardware-bound key. An attacker who steals the cookie cannot forge the required signature because the private key never leaves the chip.\n\nDBSCs directly counter a shift in attacker strategy: as 2FA and passkeys made credential phishing less effective, attackers moved to stealing active session cookies instead. Those cookies are now useless without the physical device.\n\nCurrently rolling out to a limited set of Chrome users for testing. No site changes are required for basic DBSC protection — Chrome handles the challenge-response transparently. Sites can also explicitly request DBSC challenges for specific sensitive operations. Google is expected to expand availability after the limited test.