<p>Google has shipped Device Bound Session Credentials (DBSC) in Chrome 146 for Windows, with macOS support planned for a future release.</p>
<p>The feature addresses a specific and well-established attack: stealing session cookies to hijack authenticated accounts. Even if an infostealer grabs your cookies, DBSC makes them useless almost immediately.</p>
<h2>How it works</h2>
<p>DBSC ties authentication sessions to a device’s hardware — TPM on Windows, Secure Enclave on macOS. When a session is created, Chrome generates a public/private key pair that never leaves the device. Maintaining a session requires proof of that private key, so short-lived cookies are issued only after the device demonstrates it still holds the key.</p>
<p>An attacker who exfiltrates cookies gets nothing they can use remotely. The private key stays on the machine, and without it, the stolen cookies expire worthless.</p>
<p>The protocol is also privacy-preserving by design. Each session gets a distinct key, which prevents the feature from being repurposed for cross-site tracking.</p>
<h2>Development and adoption</h2>
<p>DBSC is an open W3C standard developed with input from Microsoft, Okta, and others. Early testing with Okta showed a measurable drop in session theft. The approach shifts session security from reactive detection — noticing a stolen session after the fact — to proactive prevention.</p>
<p>Web developers can adopt DBSC by adding registration and refresh endpoints to their backends. Full specs are available through W3C and GitHub.</p>
<p>Planned future work includes federated identity support, more advanced registration capabilities, and software-based keys for devices that lack dedicated secure hardware.</p>


Collections

Chrome 146 ships Device Bound Session Credentials (DBSC) for Windows, with macOS support coming later. DBSC ties authentication sessions to device hardware (TPM on Windows, Secure Enclave on macOS) by generating a public/private key pair that never leaves the device. Short-lived cookies are only issued after the device proves it holds the private key, making stolen cookies useless to remote attackers. The feature is an open W3C standard developed with Microsoft, Okta, and others. Web developers can adopt it by adding registration and refresh endpoints to their backends. Future plans include federated identity support and software-based keys for devices without secure hardware.

Chrome 146 ships Device Bound Session Credentials to stop session cookie theft