CyberHappenings logo
☰
Home Browse Watchlists Experimental About

Track cybersecurity events as they unfold. Sourced timelines. Filter, sort, and browse. Fast, privacy‑respecting. No invasive ads, no tracking.

Chrome 146 introduces Device Bound Session Credentials to mitigate session cookie theft via infostealers

First reported
Last updated
1 unique sources, 1 articles

Summary

Hide ▲

Google Chrome 146 for Windows introduces Device Bound Session Credentials (DBSC) to prevent infostealer malware from harvesting and exploiting session cookies. The feature cryptographically binds user sessions to hardware security chips—TPM on Windows and Secure Enclave on macOS—ensuring session data cannot be exported or reused by attackers. DBSC enforces short-lived session cookies validated through possession of a unique private key stored on-device, rendering exfiltrated cookies immediately unusable. This mitigation targets the rising sophistication of infostealer families such as LummaC2, which increasingly target session cookies to bypass authentication mechanisms.

Timeline

  1. 09.04.2026 21:33 1 articles · 1h ago

    DBSC protection rolled out in Chrome 146 for Windows to counter infostealer-based session cookie theft

    Google Chrome 146 for Windows deploys Device Bound Session Credentials (DBSC) to prevent infostealing malware from harvesting and reusing session cookies. The feature cryptographically binds session credentials to the device’s security chip (TPM), ensuring private keys cannot be exported. Session validation requires proof-of-possession of the on-device private key, causing any exfiltrated cookies to expire immediately. This addresses the growing abuse of session tokens by infostealer families such as LummaC2.

    Show sources
    Open in new tab

Information Snippets