Google Chrome DBSC Feature Blocks Session Cookie Theft
TL;DR. Google's Device Bound Session Credentials (DBSC) security feature is now generally available for all Chrome users, preventing account takeovers. - DBSC cryptographically links user sessions to device hardware, like security chips, making stolen cookies unusable. - This shifts security from reactive detection to proactive prevention against session theft. - The feature rolls out to all Google Workspace and personal Google account users, enabled by default.
- Google Chrome's DBSC feature is now widely available to all users.
- DBSC binds session cookies to device hardware (e.g., TPM, Secure Enclave).
- This prevents attackers from using stolen cookies for account hijacking.
- The feature combats methods previously used by infostealers like Lumma and Rhadamanthys.
Sources
- Google Chrome adds session cookie theft protection for all users — bleepingcomputer.com