Google announced Thursday that Device Bound Session Credentials, or DBSC, are now publicly available for users on Windows who run Chrome 146, with support for macOS scheduled for an upcoming release.
The initiative targets so-called session theft, a form of account compromise in which malware infiltrates a device and extracts session cookies from the browser. According to Google, infostealer families such as LummaC2 obtain these credentials, which attackers then use to access accounts without needing the account password.
Google emphasized that once malware has gained access to a machine, no dependable software-only defense exists on any operating system to stop cookie exfiltration. DBSC seeks to address that gap by cryptographically binding an authentication session to the physical device where it originated, using security functions that are backed by hardware.
On Windows, DBSC relies on the Trusted Platform Module, while on macOS the approach uses the Secure Enclave. In both cases the platform generates a unique public/private key pair that cannot be exported from the device. Under DBSC, servers issue new short-lived session cookies only after Chrome demonstrates possession of the corresponding private key - effectively ensuring the session token is valid only on the device where the key pair resides.
Google reported that sessions protected by DBSC experienced a notable reduction in session theft during an early rollout of the protocol. The company designed DBSC through the World Wide Web Consortium process as an open web standard and worked with Microsoft in developing that standard. Web platform providers including Okta participated in two Origin Trials of the mechanism over the past year.
Looking ahead, Google said further work on DBSC will emphasize several areas. The company plans to pursue protections for federated identity by using cross-origin bindings, expand registration capabilities to allow DBSC sessions to be tied to pre-existing trusted key material, and increase device compatibility. The roadmap includes enabling software-based keys for devices that do not include dedicated secure hardware.
Context and scope
DBSC is intended to reduce the risk that stolen session cookies can be reused on other machines by making session tokens bound to non-exportable keys stored in hardware security modules. The changes apply at the browser and web authentication level and require both client-side platform support and server-side acceptance of the DBSC-bound sessions.