Chrome adopts what may be the best protection yet against account takeovers

Google's Chrome browser has quietly added a layer of defense that may finally address the weak link in modern authentication: the session cookie. The feature, called device-bound session credentials, or DBSCs, moves the cryptographic proof of a logged-in session out of the browser's reach and into the hardware itself.

For years, the security industry has focused on making the initial login harder to bypass. Two-factor authentication, passkeys, and biometric checks all raise the bar for entry. But once a user is authenticated, the server hands over a session cookie—a small token that proves the user has already passed the gate. That cookie becomes a tempting target. If an attacker steals it, they inherit the session without ever needing the password or the second factor.

DBSCs change the economics of that attack. Instead of relying solely on a cookie that can be copied and replayed from another machine, the browser generates a key that lives in the device's secure hardware—a TPM on Windows, a secure enclave on Apple platforms. The session is bound to that physical key. A stolen cookie, on its own, becomes useless because the server can verify that the session is not running on the original device.

This is not a silver bullet. An attacker with full control of the victim's device could still operate within the legitimate session. But the most common form of cookie theft—exfiltration via malware or a malicious browser extension—loses its punch. The stolen token no longer travels well.

The significance here extends beyond Chrome users. Session cookie theft has become the backdoor of choice for attackers who find multi-factor authentication too difficult to crack. By making the session itself device-bound, Google is closing a gap that has quietly undermined years of security investment. It is a structural fix, not another prompt or warning.

For the remote workforce, this matters more than most headlines. Distributed teams live in browsers. They authenticate to corporate dashboards, cloud consoles, and internal tools from laptops that move between networks and coffee shops. A stolen session cookie from one of those devices has historically been a direct path into the corporate perimeter. DBSCs raise the cost of that attack and reduce the blast radius of a single compromised machine.

The rollout is gradual, and adoption will depend on websites choosing to support the new mechanism. But the direction is clear. The industry has spent a decade fortifying the front door. Now it is finally reinforcing the windows.