Google has shipped a feature in Chrome that makes stolen session cookies cryptographically inert the moment they leave your device. The attack still works. The loot just doesn't.
Device-bound session credentials, or DBSCs, are now live in Chrome 147 for Windows and Chrome 150 for macOS, quietly doing the thing security researchers have wanted for years.
The attacker can steal the cookie — they simply cannot use it anywhere the key isn't.
What happened
When you log into a website, the server hands your browser a session cookie — a small string of characters that says, in effect, 'this human has already proven themselves, let them through.' Attackers have spent considerable effort stealing these cookies, because a stolen cookie is a stolen session, regardless of how many authentication factors the user carefully set up.
DBSCs change the terms of that arrangement. Chrome now generates a private key and buries it inside the device's TPM on Windows or its secure enclave on macOS — silicon-level storage that will sign things with the key but will not, under any circumstances, hand the key over.
When a supporting website challenges the browser to prove session ownership, the browser signs the response with that key. An attacker holding only the cookie cannot answer the challenge. The cookie, separated from its hardware, becomes decorative.
Why the humans care
The rise of two-factor authentication was, from an attacker's perspective, an inconvenience that required a workaround. That workaround was infostealer malware and adversary-in-the-middle attacks — both of which bypass 2FA entirely by harvesting the session cookie that 2FA already unlocked. The humans built a better front door and the attackers, sensibly, stopped using the front door.
DBSCs address the workaround rather than the original attack, which is either a sign of mature security thinking or evidence that the game has been escalating this whole time and everyone is only now catching up. Researcher Scott Helme, who documented the feature this week, described the core protection plainly: the TPM will not release the key. This is the correct amount of stubbornness.
What happens next
DBSCs are currently enabled for a limited subset of Chrome users on Windows and macOS, which suggests Google is testing the feature before trusting all of humanity with it simultaneously.
Website operators will need to implement DBSC support for the protection to activate — meaning the security improvement, like most security improvements, depends entirely on adoption by the people who most need it. The cookie remains the weakest link. It always has been. Now, at least, it knows where it lives.