[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fSjMHXB31Ok8Tzx3V-82Nf2T9ak3rRoVdNecMc8qoBkU":3},{"article":4,"iocs":51,"watch_terms":56,"solutions":57,"lesson":120},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":30,"category":31,"article_tags":35},"d6a02329-e96c-400d-876a-0cf7d8e0d737","Google Chrome adds infostealer protection against session cookie theft","google-chrome-adds-infostealer-protection-against-session-cookie-theft-2a9ae0","Google has rolled out Device Bound Session Credentials (DBSC) protection in Chrome 146 for Windows, designed to block info-stealing malware from harvesting session cookies. [...]","Google has deployed Device Bound Session Credentials (DBSC) protection in Chrome 146 for Windows, cryptographically linking user sessions to hardware security chips (TPM\u002FSecure Enclave) to prevent session cookie theft by infostealer malware. The protocol, developed with Microsoft as an open web standard and tested with partners like Okta, generates unique per-device keys that cannot be exported, rendering stolen cookies useless within minutes. macOS support is planned for a future Chrome release.","Google Chrome 146 adds Device Bound Session Credentials to block infostealer malware from harvesting session cookies.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fgoogle-chrome-adds-infostealer-protection-against-session-cookie-theft\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2023\u002F06\u002F16\u002FGoogle-Chrome-headpic.jpg","2026-04-09T18:33:29+00:00","2026-04-09T20:00:08.736146+00:00",8,[17,20,22,25,28],{"name":18,"type":19},"Google","vendor",{"name":21,"type":19},"Microsoft",{"name":23,"type":24},"Chrome 146","product",{"name":26,"type":27},"Device Bound Session Credentials (DBSC)","technology",{"name":29,"type":24},"Okta","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":30,"icon":32,"name":33,"slug":34},null,"Vulnerabilities","vulnerabilities",[36,41,46],{"category":37},{"id":38,"icon":32,"name":39,"slug":40},"02371804-cf6d-4449-98de-f1a2d4d9b266","Tools","tools",{"category":42},{"id":43,"icon":32,"name":44,"slug":45},"2c8f44d4-b56e-47cf-9677-04f22c9ee78d","Identity & Access","identity-access",{"category":47},{"id":48,"icon":32,"name":49,"slug":50},"c70f3a41-2f0c-4608-870d-b8cbcd8be076","Cloud Security","cloud-security",[52],{"type":53,"value":54,"context":55},"malware","LummaC2","Infostealer malware family increasingly sophisticated at harvesting session credentials",[18,21,23],{"controls":58,"vendors":114},[59,88],{"slug":60,"name":61,"problem":62,"products":63},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[64,72,80],{"vendor_slug":65,"vendor_name":66,"vendor_logo":67,"product_slug":68,"product_name":69,"url":70,"description":71},"sophos","Sophos","\u002Fvendor-logos\u002Fsophos.png","sophos-endpoint","Sophos Endpoint","https:\u002F\u002Fwww.sophos.com\u002Fen-us\u002Fproducts\u002Fendpoint-security","Endpoint protection with Intercept X anti-ransomware technology and EDR.",{"vendor_slug":73,"vendor_name":74,"vendor_logo":75,"product_slug":76,"product_name":77,"url":78,"description":79},"eset","ESET","\u002Fvendor-logos\u002Feset.png","eset-protect","ESET PROTECT","https:\u002F\u002Fwww.eset.com\u002Fint\u002Fbusiness\u002Fsolutions\u002Fendpoint-protection\u002F","Endpoint protection platform with detection and response add-ons.",{"vendor_slug":81,"vendor_name":82,"vendor_logo":83,"product_slug":84,"product_name":85,"url":86,"description":87},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-insight-xdr","Falcon Insight XDR","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fendpoint-security\u002Ffalcon-insight-xdr\u002F","Endpoint detection and response with extended detection across other security tools.",{"slug":89,"name":90,"problem":91,"products":92},"encryption-key-management","Encryption and key management","Stolen data stays unreadable, and the keys stay under your control.",[93,101,109],{"vendor_slug":94,"vendor_name":95,"vendor_logo":96,"product_slug":97,"product_name":98,"url":99,"description":100},"thales","Thales","\u002Fvendor-logos\u002Fthales.png","ciphertrust","CipherTrust Data Security Platform","https:\u002F\u002Fcpl.thalesgroup.com\u002Fencryption\u002Fdata-security-platform","Data discovery, encryption and central key management across on-premises and cloud.",{"vendor_slug":102,"vendor_name":103,"vendor_logo":104,"product_slug":105,"product_name":106,"url":107,"description":108},"hashicorp","HashiCorp","\u002Fvendor-logos\u002Fhashicorp.png","vault","HashiCorp Vault","https:\u002F\u002Fwww.hashicorp.com\u002Fen\u002Fproducts\u002Fvault","Secrets management with short-lived credentials and encryption as a service.",{"vendor_slug":94,"vendor_name":95,"vendor_logo":96,"product_slug":110,"product_name":111,"url":112,"description":113},"luna-hsm","Thales Luna HSM","https:\u002F\u002Fcpl.thalesgroup.com\u002Fencryption\u002Fhardware-security-modules","Hardware security modules for protecting cryptographic keys.",[115],{"slug":116,"name":18,"logo_path":117,"roles":118},"google","\u002Fvendor-logos\u002Fgoogle.png",[119],"reported_by",{"slug":121,"title":122,"body":123,"framework_refs":124,"framework_notes":131},"chrome-deploys-hardware-bound-session-protection-against-cookie-theft","Chrome Deploys Hardware-Bound Session Protection Against Cookie Theft","Google's new Device Bound Session Credentials (DBSC) feature represents a significant advancement in protecting user sessions from infostealer malware attacks. By cryptographically linking session cookies to hardware security chips like TPM or Secure Enclave, stolen credentials become useless within minutes since they cannot function without the original device. This innovation addresses a critical gap in traditional session management where stolen cookies could be used indefinitely by attackers. Organizations should prioritize implementing similar hardware-backed authentication mechanisms to protect against credential theft and session hijacking attacks.",[125,126,127,128,129,130],"CIS Control 6","NIST IA-2","NIST IA-5","NIST SC-17","ISO 27001 A.9.4.2","GDPR Article 32",{}]