Google Launches DBSC in Chrome to Block Session Theft

Google has launched a new security feature in its Chrome browser to combat session theft, a common tactic used by cybercriminals to hijack user accounts. The update, called Device Bound Session Credentials (DBSC), is now available in Chrome version 146 for Windows users and binds authentication sessions to a specific device, rendering stolen cookies useless to attackers. Support for macOS will follow in an upcoming release.

Session theft occurs when malware, such as the LummaC2 infostealer, infiltrates a device and extracts authentication cookies from browser files or memory. These cookies, which allow access to accounts without re-entering passwords or multifactor authentication, can have long lifespans and are often sold on dark web forums. Traditional defenses focus on detecting theft after it happens, but persistent attackers frequently evade them. DBSC shifts to proactive prevention by using hardware-backed security modules, like the Trusted Platform Module on Windows or the Secure Enclave on macOS, to generate a unique public-private key pair that cannot be exported from the device.

When a user authenticates, Chrome proves possession of the private key to the server before...