Google Chrome Adding Protection Against Cookie-Stealing Malware

[fria]

Google announced on their security blog that Device Bound Session Credentials (DBSC), a protection against session theft, are shipping for Windows users on Chrome 146.

---

This is a companion discussion topic for the original entry at https://www.privacyguides.org/news/2026/04/14/google-chrome-adding-protection-against-cookie-stealing-malware

[Onscreen5341]

Chrome rolls out hardware-bound session protection to combat infostealer malware

The DBSC protocol works by binding session cookies to a specific device using hardware-backed cryptographic keys. On Windows systems, this relies on the Trusted Platform Module (TPM), while macOS devices use the Secure Enclave. When a user authenticates, Chrome generates a unique public-private key pair stored securely on the device, with the private key never leaving the hardware. Servers then require proof of possession of this private key before issuing or refreshing short-lived session co…