Google has rolled out a new security mechanism in Chrome designed to prevent a growing class of account takeover attacks that have become more prevalent as users adopt stronger authentication methods like two-factor authentication and passkeys.
The protection, called device-bound session credentials (DBSCs), works by storing a unique encryption key within hardware-based security modules built into devices. On Windows machines, this is achieved through the Trusted Platform Module (TPM), while macOS and iOS systems utilize secure enclaves. The feature has been implemented in recent versions of Chrome for Windows and macOS.
Session cookies—unique character strings that websites store in browsers to maintain user authentication—have become an attractive target for attackers. These cookies speed up browsing by eliminating the need to re-authenticate each time a user accesses a new page. However, as traditional password-stealing methods have become less effective against accounts protected by multi-factor authentication, malicious actors have increasingly turned to stealing session cookies through infostealer malware and man-in-the-middle attacks. Once obtained, attackers can paste these cookies into their own browsers to gain unauthorized access.
DBSCs address this threat by requiring that session cookies be cryptographically signed using the private key stored within the device’s hardware security module. Because the TPM or secure enclave prevents the extraction of the private key, attackers who steal a cookie cannot use it without the original device. This creates a fundamental barrier that traditional cookie theft cannot overcome.
Currently, the feature is available only in Chrome version 147 for Windows and 150 for macOS, and only for a limited subset of users as Google tests the technology before broader deployment. Users can verify whether DBSC protection is active on their device by checking the developer tools. While it remains unclear whether other Chromium-based browsers will adopt this technology, industry observers expect widespread implementation to follow.
Article Attribution | Read More at Article Source
Article summary produced by Claude AI