Google Chrome adds session cookie theft protection for all users
Google says Chrome's device-bound session credentials are now generally available to help stop stolen cookies from being reused to hijack accounts.
Intelligence analysis by GPT-5.4 Mini
Chrome is rolling out Device Bound Session Credentials, which tie session cookies to a specific device so stolen cookies are much less useful to attackers. Google says the change is now available across Workspace and personal accounts.
Chrome is adding a new lock for login cookies, which are tiny bits of data that help websites remember a user after sign-in. The lock is tied to the device itself, like a key that only fits one special door.
That means if a thief steals the cookie, it may not work anywhere else. It is a lot like stealing a library card but finding out it only works when the right person uses it at the right desk.
Google says this should make account theft harder, especially when bad software tries to steal sign-in data. It does not fix every problem, but it closes one important door.
Analysis
What changed
Google says Chrome's Device Bound Session Credentials, or DBSC, is now generally available and rolling out to all users. The feature was in beta since April and was first announced in 2024.
DBSC is meant to stop attackers from reusing stolen session cookies. Instead of letting a cookie work on any machine, Chrome links the session to the device that authenticated it. Google says the binding relies on hardware-backed keys from security chips such as TPM on Windows and Secure Enclave on macOS.
Why that helps
The point is not to stop login entirely. It is to make stolen session data much less valuable after login. If malware or an infostealer grabs a cookie, the cookie alone should not be enough to access the account from another device.
Google says the rollout covers Google Workspace customers, Workspace Individual subscribers, and personal Google accounts. Workspace customers will get it by default, and administrators cannot turn it off.
The article connects this to earlier abuse patterns, including an undocumented Google OAuth "MultiLogin" endpoint that threat actors used to generate fresh cookies after old ones expired. It also mentions Lumma and Rhadamanthys, which reportedly claimed they could restore expired Google authentication cookies stolen from infected systems.
Google's message is that DBSC shifts the defense from trying to notice stolen cookies after the fact to making those cookies unusable in the first place. It also says the feature reduces risk even when malware is present on the device, because attackers still need the device-bound cryptographic keys to use the session.
Key points
- Google says Chrome's Device Bound Session Credentials are now generally available.
- The feature ties session cookies to the device that logged in, using hardware-backed keys.
- Google says the rollout is automatic for Workspace customers and cannot be disabled by admins.
- The goal is to reduce account takeovers that rely on stolen cookies and infostealer malware.
