Google has made Device Bound Session Credentials (DBSC) generally available to all Windows users of Chrome 146, with macOS expansion planned in an upcoming Chrome release.
What is DBSC?
DBSC links a user’s browser session to the device’s security hardware — the Trusted Platform Module (TPM) on Windows and the Secure Enclave on macOS. During session creation, the security chip generates a unique pair of public and private keys. Since the private key can’t be exported from the device, any session cookie stolen by malware becomes useless elsewhere.
How It Works:
- Hardware-backed security: Google uses TPM on Windows and the Secure Enclave on macOS to generate a unique public/private key pair that cannot be exported from the machine.
- Short-lived cookies only: The issuance of new short-lived session cookies is contingent upon Chrome proving possession of the corresponding private key to the server. Because attackers cannot steal this key, any exfiltrated cookies quickly expire and become useless.
- Transparent refresh: When short-lived cookies expire, Chrome proves possession of the private key before refreshing them.
Threat It Addresses:
Session theft involves the covert exfiltration of session cookies from the web browser to an attacker-controlled server, typically through information-stealing malware. DBSC makes stolen cookies useless because they can’t be refreshed on another device.
Current Limitations:
- Currently, DBSC is available only on Chrome browser for Windows devices. (macOS coming soon)
- Requires TPM hardware support
- Gracefully falls back to standard behavior on unsupported devices
For Enterprise:
Administrators can enable DBSC to prevent session hijacking and protect Google Workspace accounts, and can enforce DBSC-bound sessions for access to specific apps through Context-Aware Access.
This is a significant move toward cryptographic session binding at the HTTP layer—a stronger architecture than bearer-token cookies alone. It’s a practical response to the explosion of info-stealing malware (LummaC2, Vidar, etc.) targeting credential exfiltration. For practitioners, this means session security is now hardware-dependent; it’s worth understanding the TPM requirements in your environment.
