Chrome tests new defense against session cookie theft
Google Chrome is rolling out Device Bound Session Credentials (DBSC), a feature designed to block account takeovers even when attackers steal session cookies. The protection relies on a private key locked inside a device's security chip.
Google is testing a new security feature in Chrome, Device Bound Session Credentials (DBSC), aimed at closing one of the most common paths attackers use to hijack online accounts: stealing session cookies.
Normally, if an attacker manages to steal a user's session cookie, they can log into that account without needing a password or two-factor code. DBSC changes this by tying a session to the specific device that created it. Once a site sets a session cookie, the browser must sign a version of it using a key held inside the device's TPM or secure enclave chip.
How the protection works
Security researcher Scott Helme, founder of Report URI, explained that an attacker can still steal the cookie itself, but cannot complete the authentication challenge the server sends back, since doing so requires signing with the private key — and that key never leaves the secure hardware. Servers store only the corresponding public key and check whether the signed response, called an authentication assertion, matches it. If not, the request is rejected.
This approach mirrors how passkeys work, another technology that removes reliance on shared secrets that can be stolen and reused by attackers.
Limited rollout so far
DBSC currently works only in Chrome version 147 on Windows and version 150 on macOS, and even there it's enabled for just a limited set of users, suggesting Google is still testing before a wider release. Users can check whether it's active by opening developer tools, going to the Application tab, and looking for a "device bound sessions" entry when logged into a supporting site.
It remains unclear whether or when other Chromium-based browsers will adopt DBSC, though observers expect it is likely to spread beyond Chrome.
