Google has rolled out a new security feature in its Chrome browser designed to combat an expanding threat vector in account takeover attacks. The technology, called device-bound session credentials (DBSCs), leverages hardware-based security mechanisms to protect authentication credentials that have become vulnerable as cybersecurity practices have evolved.
Session cookies are small data strings that websites use to maintain user authentication status, eliminating the need to re-enter credentials with each page visit. However, these cookies have become an increasingly attractive target for attackers as organizations have implemented stronger protections such as two-factor authentication and passkey systems. With traditional password-based attacks becoming less effective, malicious actors have shifted their approach to stealing session cookies through infostealer malware and man-in-the-middle attacks, then using those stolen cookies to gain unauthorized access to accounts.
The DBSC protection addresses this vulnerability by binding session authentication to a unique encryption key stored in hardware security modules built into devices. On Windows systems, this is accomplished through the Trusted Platform Module (TPM); macOS and iOS devices use the secure enclave. The hardware design prevents extraction of the private key, ensuring that even if attackers successfully steal session cookies, they cannot use them without access to the device’s hardware-protected key.
The feature is currently available in Chrome version 147 for Windows and version 150 for macOS, though it remains in limited rollout to specific users, indicating that Google is conducting testing before wider deployment. Users can verify whether the feature is active by accessing browser developer tools. The implementation represents a shift toward authentication models that eliminate reliance on shared secrets, instead using challenge-response mechanisms similar to those employed by passkey authentication systems. While DBSC support is presently limited to Chrome, adoption by other Chromium-based browsers is considered likely in the future.
Article Attribution | Read More at Article Source
Article summary produced by Claude AI