Chrome's new device-bound credentials aim to stop session cookie theft

Google has rolled out a new Chrome security feature designed to block a growing class of account takeovers that exploit session cookies—even when users have enabled two-factor authentication, passkeys, and other defenses.

How device-bound credentials work#

The technology, called device-bound session credentials (DBSCs), tethers authentication tokens to a device's hardware security layer. Chrome stores an encryption key in the protected chip built into most modern computers: a Trusted Platform Module (TPM) on Windows, a Secure Enclave on macOS and iOS, or equivalent security hardware on other platforms. This approach means session credentials become worthless if copied to a different device or extracted by attackers.

Recent versions of Chrome for Windows and macOS now generate keys locked to this hardware, preventing attackers from using stolen credentials elsewhere.

Why session cookies became a target#

Session cookies are short-lived authentication tokens that servers place on browsers to avoid requiring fresh login credentials with every page load. They're essential for user experience on sensitive sites—but they're also valuable prey for attackers.

As stronger authentication methods like passkeys gained adoption, traditional attack vectors like phishing and password spraying became less effective. Attackers pivoted: instead of trying to steal passwords, they now target the session cookies that already grant full access to authenticated accounts.

Two main methods are now widespread: infostealer malware that harvests cookies directly from infected devices, and man-in-the-middle attacks that intercept cookies in transit. Once stolen, attackers can paste these cookies into their own browser and impersonate the legitimate user—a fast, reliable path to account compromise that bypasses modern authentication barriers.