Google Chrome’s rollout of Device Bound Session Credentials is an important step against one of the most damaging modern attack techniques: session cookie theft. Infostealer malware often steals browser cookies after a user has already logged in, allowing attackers to bypass passwords and MFA and take over accounts using valid sessions.
With DBSC, Chrome cryptographically binds authentication sessions to the user’s device using hardware-backed security such as TPM on Windows and Secure Enclave on macOS. This means that even if malware steals a session cookie, the attacker cannot easily reuse it from another machine because the required private key remains tied to the original device.

This is a major improvement, especially as infostealers like Lumma, Vidar, StealC, and similar malware families continue targeting browser data, passwords, crypto wallets, and session tokens. Naturally, attackers adapted to MFA by stealing what comes after MFA, because apparently every security control becomes a puzzle invitation. 

However, organizations should not treat this as a complete fix. DBSC helps reduce the value of stolen session cookies, but it does not stop malware from stealing files, passwords, tokens, browser data, screenshots, wallets, or business documents. Endpoint protection, DNS filtering, safe browsing controls, least privilege, application control, and user awareness are still essential. 

The broader lesson is simple: identity security must protect the full session lifecycle, not just login. Passwords and MFA are important, but attackers now target active sessions, device trust, OAuth tokens, and browser-stored data. Binding sessions to devices raises the cost for attackers, and that is exactly the kind of friction modern account security needs.

Google says the Chrome Device Bound Session Credentials (DBSC) security feature is now generally available and is rolling out to all users to prevent account takeovers. [...]

Source: Google Chrome adds session cookie theft protection for all users via Bleeping Computer — published 29 May 2026.