VulnerabilitiesApr 9, 2026

Google Chrome adds infostealer protection against session cookie theft

Google Chrome 146 adds Device Bound Session Credentials to block infostealer malware from harvesting session cookies.

Google has deployed Device Bound Session Credentials (DBSC) protection in Chrome 146 for Windows, cryptographically linking user sessions to hardware security chips (TPM/Secure Enclave) to prevent session cookie theft by infostealer malware. The protocol, developed with Microsoft as an open web standard and tested with partners like Okta, generates unique per-device keys that cannot be exported, rendering stolen cookies useless within minutes. macOS support is planned for a future Chrome release.

AI summary of the linked source. Not reviewed by an editor. How this works

Read at source

Vendor Watch

Run Google?

Get an email when a new story names Google, usually within the hour.

Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch works Privacy

The lesson from this incident

Full lesson

Google's new Device Bound Session Credentials (DBSC) feature represents a significant advancement in protecting user sessions from infostealer malware attacks. By cryptographically linking session cookies to hardware security chips like TPM or Secure Enclave, stolen credentials become useless within minutes since they cannot function without the original device. This innovation addresses a critical gap in traditional session management where stolen cookies could be used indefinitely by attackers. Organizations should prioritize implementing similar hardware-backed authentication mechanisms to protect against credential theft and session hijacking attacks.

What helps against this

How we list vendors

Google research

Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
For exampleSophos Endpoint ESET PROTECT CrowdStrike Falcon Insight XDR all options
Encryption and key management
Stolen data stays unreadable, and the keys stay under your control.
For exampleThales CipherTrust Data Security Platform HashiCorp Vault Thales Luna HSM all options

Indicators of Compromise

Extracted by AI from the linked source. Not reviewed by an editor. How this works

malware — LummaC2

Entities

Google (vendor)Microsoft (vendor)Chrome 146 (product)Device Bound Session Credentials (DBSC) (technology)Okta (product)