Chrome introduces device-bound session credentials to curb cookie hijacking

Chrome's newest security measure, called device-bound session credentials, embeds a distinct encryption key within the device's built-in hardware protector—TPM on Windows or secure enclave on macOS and iOS. Recent browser builds generate and store this key, linking session cookies to the specific device. Because session cookies normally allow seamless access to authenticated sites, stealing them lets attackers impersonate users; DBSCs prevent that by making the cookies unusable on other machines.

The change addresses a growing threat where criminals use infostealer malware or man-in-the-middle techniques to capture cookies after traditional password-only attacks have been mitigated by 2FA and passkeys. By tying authentication tokens to hardware, Chrome aims to strengthen user accounts against sophisticated hijacking attempts.