Google Chrome introduces hardware-bound credentials to prevent account theft

Google is rolling out a new security feature in the Chrome browser called Device Bound Session Credentials (DBSC) to combat session cookie theft and account takeovers. This technology aims to neutralize the effectiveness of infostealer malware and man-in-the-middle attacks by binding a user's session to a private key stored directly in their device's hardware.

Unlike traditional session cookies, which act as bearer tokens that can be used from any location once stolen, DBSC requires the browser to sign an authentication challenge using a private key. This key is isolated within secure hardware environments, such as the Trusted Platform Module (TPM) on Windows or the Secure Enclave on macOS and iOS, making it impossible for attackers to extract. Even if a cookie is stolen, the attacker cannot respond to the server's challenge without the hardware-protected key.

The feature is currently in a staged rollout. It is available in Chrome version 147 for Windows and version 150 for macOS, though it is currently enabled for a limited group of users for testing. Users can verify if the protection is active by checking the Application tab in Chrome Developer Tools for a “device bound sessions” message on supported websites.