Chrome introduces hardware-bound credentials to counter session cookie theft
Device-bound session credentials store encryption keys in silicon-resident modules, ensuring stolen cookies cannot be used for account takeovers
Google has begun testing device-bound session credentials (DBSCs) in its Chrome browser, a security measure designed to mitigate the risk of session cookie theft and subsequent account takeovers. The update represents a significant shift in how browsers handle authentication, moving away from shared secrets towards hardware-bound verification.
The mechanism functions by storing unique encryption keys within silicon-resident hardware security modules native to the user’s device. On Windows systems, these keys are housed in the Trusted Platform Module (TPM), while macOS and iOS devices utilise the Secure Enclave. This architecture ensures that the private keys required to sign session cookies remain isolated within the device’s hardware, preventing extraction by malicious software.
Session cookies allow users to remain authenticated across web pages without re-entering credentials, but they have become a primary target for cybercriminals. As two-factor authentication and passkeys have reduced the efficacy of traditional password phishing, attackers have increasingly relied on infostealer malware and adversary-in-the-middle attacks to steal these cookies. Once obtained, the stolen data allows intruders to impersonate the victim until the session expires.
DBSCs disrupt this attack chain by requiring browsers to sign session cookies with the isolated hardware key. Web servers store the corresponding public key and issue authentication challenges that must be signed by the private key residing in the TPM or Secure Enclave. Scott Helme, a researcher and founder of Report URI, confirmed that this structure prevents attackers from utilising stolen cookies, as they cannot generate the required signed assertion without access to the device-bound private key.
The feature is currently available in Chrome version 147 for Windows and version 150 for macOS, though it is enabled only for a limited cohort of users as part of an ongoing testing phase. Users can verify if the protection is active by checking for "device bound sessions" within the browser’s developer tools under the application tab. While other Chromium-based browsers may adopt the standard in the future, Google has not yet confirmed a wider rollout timeline.
