The Chrome browser, developed by Google, has incorporated new functionality capable of significantly improving account takeover prevention. This type of online fraud has intensified, even with increasing user adoption of methods such as two-factor authentication and other more robust passwords. The measure was implemented on August 11, 2026, aiming to strengthen user security.
Called Device-Bound Session Credentials (DBSCs), this new feature works by storing a unique encryption key. It resides in a security layer already present on the device that runs the browser. On Windows systems, this technology is known as Trusted Platform Module (TPM), while on macOS and iOS devices, the designation is secure enclave. Other platforms have different terms for this layer. The latest versions of Chrome for Windows and macOS are already equipped to generate and store this key securely.
How device-bound session credentials work against theft
DBSCs act as a barrier against session cookie theft. These cookies are unique sequences of characters that internet portals store in users’ browsers. Their main function is to speed up navigation on platforms that require constant authentication. Instead of requesting credentials with each new page accessed, the server simply recognizes the previous login through the session cookie.
More on this story: Block stolen cell phone: essential steps to protect your data and track the device
The tactic of stealing session cookies has become more prevalent as security methods such as two-factor authentication (2FA) and passkeys have gained popularity. These innovations add layers of verification, going beyond a single password to allow access to restricted pages. As a result, phishing attacks and other older approaches to compromising accounts have reduced their effectiveness.
To circumvent these new defenses, virtual criminals began to use malicious software more frequently to steal information and carry out attacks known as “adversary in the middle” (AIM). Both strategies rely on bypassing session cookies. Once they have the cookies in hand, the attackers insert them into their own browsers, thus achieving the same level of access as the real user, even if for a limited period.
Follow: all about account theft
DBSCs represent a direct defense against the theft of these cookies. The moment a website sets a session cookie, the user’s browser is required to transmit a signed version of the cookie, using the cryptographic key stored in the security chip. The characteristics of the TPM or secure enclave guarantee the isolation of this key, preventing any attempt to extract it. The process is designed for maximum safety.
“The attacker cannot steal the device’s private key because the TPM/Secure Enclave does not release it. This is the main protection,” said Scott Helme, researcher and founder of Report URI. He explained that even if the attacker manages to steal the cookie, they will not be able to respond to a DBSC challenge, as the private key remains inaccessible and secure within the user’s device.
Full coverage: Latest News (EN)
Device-Bound Sessions (DBSCs) are currently only available for Chrome version 147 on Windows and 150 on macOS. However, the functionality is accessible to a restricted group of users. Apparently, Google is in the testing phase before rolling out the protection widely. To verify that the tool is active, Chrome users on these operating systems can open the developer tools, navigate to the “Applications” tab, and verify that the “Sessions linked to device” message appears when logging into a supported website.
There is still no clarity on when, or even if, other browsers built on the Chromium platform will incorporate DBSCs, but the expectation is that this adoption will occur in the near future.
DBSCs represent the latest advancement in authentication, seeking to eliminate reliance on shared secrets, which have historically proven vulnerable to theft. In this new paradigm, web servers start to store each visitor’s public key. These servers later send an authentication challenge that involves the session cookie. For the authentication statement to be accepted, it needs to be signed by the private key, which remains protected in the TPM or secure enclave of the device. This mechanism is similar to how access keys work, which also aim to strengthen digital security.