Chrome's device-bound session credentials take a big bite out of cookie theft

Google has started rolling out a new Chrome security feature that could significantly blunt one of the most common account-takeover techniques used today: session cookie theft. Called device-bound session credentials (DBSCs), the protection pairs a website's session cookie with a cryptographic key stored in dedicated security hardware inside the user's device. On Windows that's a TPM; on macOS and iOS, it's the Secure Enclave. The result is that even if an attacker steals a session cookie, they can't use it without also possessing the private key, which the hardware refuses to give up.

The feature is a direct response to a shift in attacker behavior. As two-factor authentication and passkeys have made password theft less effective, criminals have increasingly turned to infostealer malware and adversary-in-the-middle attacks that swipe session cookies directly. Those cookies let an attacker impersonate a logged-in user without needing credentials at all. DBSCs break that chain by requiring each request to be signed with a key that never leaves the secure hardware.

Here's how it works in practice: when a site sets a session cookie, the browser must also generate an assertion signed with the private key stored in the TPM or Secure Enclave. The server verifies the signature using the corresponding public key. If an attacker tries to replay a stolen cookie from a different device, the signature won't match, and the session is rejected. As security researcher Scott Helme put it: "The attacker can steal the cookie, but they can't answer a DBSC challenge by signing it with the private key."

The feature is currently limited to Chrome 147 on Windows and Chrome 150 on macOS, and only for a subset of users as Google tests the waters. It's also only active on sites that opt in to supporting DBSCs, so adoption will take time. But the architecture is a logical extension of the shift toward hardware-backed authentication that passkeys popularized, and it's likely other Chromium-based browsers will follow suit.

For developers, the rollout signals that hardware-bound session management is becoming a practical expectation rather than a theoretical nicety. Websites that support passkeys or other WebAuthn flows are well-positioned to adopt DBSCs, and doing so could meaningfully harden their sessions against the most common attack vector in the wild. Chrome users on Windows and macOS can check whether DBSCs are active by opening DevTools, clicking the Application tab, and looking for "device bound sessions" under a logged-in site.

It's early days, and Google hasn't said when DBSCs will reach general availability or expand to other platforms. But the direction is clear: the era of relying solely on server-side session tokens is coming to a close, and hardware-backed identity is becoming the new baseline.