Google's DBSC Ties Sessions to Device-Specific Keys

Google has introduced Device Bound Session Credentials (DBSC), a security feature that makes it difficult for attackers to reuse stolen authentication cookies on another device. DBSC binds sessions to a cryptographic key protected by hardware-backed security, such as Trusted Platform Module (TPM) on Windows and Secure Enclave on macOS.

The feature is now available for Windows users on Chrome 146 and will be coming to macOS in an upcoming release. Google said that software alone cannot reliably stop cookie exfiltration once malware can read browser files and memory, so security teams have often had to rely on detecting and invalidating stolen sessions after the fact.

DBSC works by requiring Chrome to prove it still holds the device's private key before refreshing short-lived session cookies. If an attacker exfiltrates a cookie without the corresponding key, the cookie expires and cannot be renewed from another machine.