Google says its Chrome Device Bound Session Credentials security feature is now generally available and is rolling out to users to help prevent account takeovers caused by stolen session cookies.
The feature, known as DBSC, has been available in beta since April and was first announced in 2024. It is designed to cryptographically bind session cookies to a specific device, making it much harder for hackers to use stolen cookies to bypass multi-factor authentication and take over accounts.
Session cookies are small files used by websites to remember that a user is already signed in. Attackers often try to steal these cookies with malware and use them to access accounts without needing a password or MFA code. DBSC changes that by linking the session to the user’s actual device.
The feature works by connecting the user session to hardware security features on the device, such as the Trusted Platform Module on Windows computers and the Secure Enclave on macOS. These chips generate unique public and private keys used to protect sensitive data.
Because the private keys are created and stored inside the device’s security hardware, attackers cannot simply steal them like normal files. That means even if malware manages to steal session cookies from a device, those cookies cannot easily be used on another computer.
Google said DBSC changes how the web defends against cookie theft by moving from reactive detection to proactive prevention. Instead of only trying to detect stolen cookies after an attack, the feature helps stop those cookies from working outside the device where the user originally signed in.
The company also said DBSC strengthens account security after login by binding session cookies to the authenticated device. Even if malware is present on a user’s computer, DBSC reduces the risk of session theft and makes it more difficult for attackers to exploit stolen cookies.
The feature is now rolling out to Google Workspace customers, Workspace Individual subscribers, and users with personal Google accounts. Google said DBSC will be enabled by default for all Google Workspace customers once it becomes available, and administrators will not be able to turn it off.
Stolen Google authentication cookies have been abused in the past by threat actors to access accounts even after passwords were changed or session cookies expired. Some malware operations, including Lumma and Rhadamanthys, have claimed they could restore expired Google authentication cookies stolen from infected devices.
Google previously advised users to remove malware from their devices and enable Chrome’s Enhanced Safe Browsing mode to improve protection against phishing and malware. With DBSC now rolling out more widely, stolen cookies should become far less useful to attackers because they will not have access to the cryptographic keys required to use them.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
