Google Makes Device-Bound Session Credentials Available to Windows Chrome Users
Summary
Google made DBSC generally available on Chrome 146 for Windows, using hardware-backed keys to bind short-lived session cookies to devices. macOS support is planned; devices without secure key storage fall back to standard cookie behavior.
Key points
- DBSC is generally available to Windows users on Chrome 146; Google plans to expand support to macOS in a future release.
- The feature uses hardware-backed keys, such as a Windows TPM, and requires proof of key possession to issue new short-lived session cookies.
- DBSC targets session-cookie theft associated with information stealers, including Atomic, Lumma, and Vidar Stealer.
- Devices without supported secure key storage fall back to standard cookie behavior, according to Google.
- Google reports a significant reduction in session theft since DBSC launched, but the article provides no measurement details.
- Google says the design limits information sent to servers to a per-session public key and is intended to avoid cross-site tracking and device fingerprinting.
Article Details
- Event Type
- Google made Device Bound Session Credentials (DBSC) generally available to Windows users on Chrome 146.
- Impact
- DBSC binds short-lived session cookies to device-specific hardware-backed keys, making stolen cookies unusable after they expire without proof of the corresponding private key. Google reports a significant reduction in session theft during testing. Devices without secure key storage fall back to standard cookie behavior.
MITRE ATT&CK
Malware
ATOMICto bind short-lived session cookies to a device, preventing stolen cookies—harvested by stealers like Atomic, Lumma, and Vidar Stealer—from being reused.Lummashort-lived session cookies to a device, preventing stolen cookies—harvested by stealers like Atomic, Lumma, and Vidar Stealer—from being reused.Vidarsession cookies to a device, preventing stolen cookies—harvested by stealers like Atomic, Lumma, and Vidar Stealer—from being reused.
Vendors
GoogleGoogle has made Device Bound Session Credentials (DBSC) generally available to Windows users on Chrome 146, with macOS expansion planned in a future release.MicrosoftGoogle, which worked with Microsoft to design the standard with an aim to make it an open web standard, also emphasized that the DBSC architecture is private by design and that the distinct key approach ensures that
Products
Device Bound Session Credentials (DBSC)Google has made Device Bound Session Credentials (DBSC) generally available to Windows users on Chrome 146, with macOS expansion planned in a future release.Google ChromeGoogle has made Device Bound Session Credentials (DBSC) generally available to Windows users on Chrome 146, with macOS expansion planned in a future release.