cyber.hendryadrian.com
Security News · bleepingcomputer.com

Chrome 146 Adds Hardware-Bound Session Cookie Protection on Windows

· Original article ↗

Summary

Chrome 146 for Windows adds DBSC, which binds session cookies to hardware-backed keys to hinder infostealer reuse. Google says testing with web-platform partners, including Okta, saw a decline in session theft; macOS support is planned.

Key points

  • Chrome 146 on Windows enables Device Bound Session Credentials (DBSC), tying sessions to hardware-backed keys held by the device’s TPM.
  • Servers require proof of possession of the private key to issue short-lived session cookies, making stolen cookies less useful off-device.
  • Google says DBSC testing with multiple web-platform partners, including Okta, observed a decline in session theft events.
  • Google says infostealers such as LummaC2 harvest session cookies, which can allow account access without entering credentials.
  • Google says macOS support is planned for a future Chrome release, using the Secure Enclave.
  • Websites can adopt DBSC by adding registration and refresh endpoints; the protocol was developed with Microsoft as an open web standard.

Article Details

Event Type
Google rolled out Device Bound Session Credentials (DBSC) in Chrome 146 for Windows to protect session cookies from infostealer theft.
Impact
DBSC binds sessions to hardware-backed keys and requires proof of possession to issue short-lived cookies, making exfiltrated cookies unusable off-device. Google reported a notable decline in session theft during testing with web-platform partners, including Okta. macOS support is planned for a future Chrome release.

MITRE ATT&CK

T1539 · Steal Web Session CookieThe article describes infostealer malware harvesting session cookies, the behavior covered by Steal Web Session Cookie.

Malware

LummaC2macOS support will arrive in a future Chrome release, and testing with partners like Okta showed a decline in session theft by infostealers such as LummaC2.

Vendors

GoogleGoogle introduced Device Bound Session Credentials (DBSC) in Chrome 146 for Windows to cryptographically bind session cookies to hardware-backed keys, blocking info-stealing malware from reusing stolen credentials.MicrosoftDBSC was developed as an open standard with Microsoft, tested with partners like Okta, and has W3C specs and implementation guides on GitHub.OktamacOS support will arrive in a future Chrome release, and testing with partners like Okta showed a decline in session theft by infostealers such as LummaC2.

Products

Google ChromeGoogle introduced Device Bound Session Credentials (DBSC) in Chrome 146 for Windows to cryptographically bind session cookies to hardware-backed keys, blocking info-stealing malware from reusing stolen credentials.

Related Articles