--- title: Chrome adopts what may be the best protection yet... description: Chrome has introduced Device-Bound Session Credentials (DBSCs), a new security feature that stores a unique encryption key inside hardware-level secure storage... canonical: https://daily.dev/posts/chrome-adopts-what-may-be-the-best-protection-yet-against-account-takeovers-8zoybvphu twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Chrome adopts what may be the best protection yet against account takeovers | daily.dev og:description: Chrome has introduced Device-Bound Session Credentials (DBSCs), a new security feature that stores a unique encryption key inside hardware-level secure storage... og:url: https://daily.dev/posts/chrome-adopts-what-may-be-the-best-protection-yet-against-account-takeovers-8zoybvphu og:image: https://api.daily.dev/og/posts/8zoYBvPhu.png og:image:alt: Chrome adopts what may be the best protection yet against account takeovers og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Chrome adopts what may be the best protection yet against account takeovers **[Ars Technica](https://daily.dev/sources/arstechnica)** · 2 min read · 5 upvotes · 0 comments ## Summary Chrome has introduced Device-Bound Session Credentials (DBSCs), a new security feature that stores a unique encryption key inside hardware-level secure storage — TPM on Windows, Secure Enclave on macOS/iOS — to protect against session cookie theft. As 2FA and passkeys have made traditional phishing less effective, attackers have shifted to infostealer malware and adversary-in-the-middle attacks that steal session cookies and replay them in attacker-controlled browsers. DBSCs bind session credentials to the physical device, making stolen cookies useless without the corresponding hardware key. The feature is available in recently released Chrome versions for Windows and macOS. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What are device-bound session credentials (DBSCs) in Chrome? Device-bound session credentials are a Chrome security feature that binds session cookies to a unique encryption key stored in device hardware, such as a Windows TPM or a macOS/iOS secure enclave. This prevents stolen session cookies from being used on a different device, since the cookie's validity depends on the hardware-resident key that cannot be copied elsewhere. Recently released versions of Chrome for Windows and macOS generate this key. _Teams hardening authentication flows track browser security changes like DBSCs on daily.dev._ ### How do attackers bypass 2FA and passkeys using session cookie theft? Attackers use infostealer malware and adversary-in-the-middle phishing attacks to steal session cookies from a victim's browser, then paste those cookies into their own browser to gain the same authenticated access as the rightful owner. Because the session cookie already proves a completed login, this bypasses 2FA and passkey protections that only guard the initial authentication step, not the session token that follows. _Anyone investigating account takeover techniques can follow session security developments on daily.dev._ ## Similar posts on daily.dev - [Google Chrome adds session cookie theft protection for all users](https://daily.dev/posts/google-chrome-adds-session-cookie-theft-protection-for-all-users-hmsdzdl44) · BleepingComputer · 36 upvotes · 10 comments - [Device Bound Session Credentials now available on Windows](https://daily.dev/posts/device-bound-session-credentials-now-available-on-windows-z7l2wmrgc) · Chrome Developers · 3 upvotes · 0 comments - [Understanding Device Bound Session Credentials \(DBSC\)](https://daily.dev/posts/understanding-device-bound-session-credentials-dbsc--lenaynz6n) · .NET Escapades · 0 upvotes · 0 comments - [DBSC Beta at Report URI](https://daily.dev/posts/dbsc-beta-at-report-uri-cdmfmeipg) · Scott Helme · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#google-chrome](https://daily.dev/tags/google-chrome) [View this post on daily.dev](https://daily.dev/posts/chrome-adopts-what-may-be-the-best-protection-yet-against-account-takeovers-8zoybvphu) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Chrome adopts what may be the best protection yet against account takeovers","url":"https://daily.dev/posts/chrome-adopts-what-may-be-the-best-protection-yet-against-account-takeovers-8zoybvphu","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/chrome-adopts-what-may-be-the-best-protection-yet-against-account-takeovers-8zoybvphu"},"datePublished":"2026-08-11T21:03:08.771Z","dateModified":"2026-09-14T07:41:38.376Z","description":"Chrome has introduced Device-Bound Session Credentials (DBSCs), a new security feature that stores a unique encryption key inside hardware-level secure storage...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/7c17fbc6b9bd565f54b2827ae00f6a65?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/7c17fbc6b9bd565f54b2827ae00f6a65?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Ars Technica","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Ars Technica","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/80883e0e48a34b5ebcf93777016cb3fe","url":"https://daily.dev/sources/arstechnica"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/chrome-adopts-what-may-be-the-best-protection-yet-against-account-takeovers-8zoybvphu","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":5},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,google-chrome","timeRequired":"PT2M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Ars Technica","item":"https://daily.dev/sources/arstechnica"},{"@type":"ListItem","position":3,"name":"Chrome adopts what may be the best protection yet against account takeovers"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/chrome-adopts-what-may-be-the-best-protection-yet-against-account-takeovers-8zoybvphu#faq","mainEntity":[{"@type":"Question","name":"What are device-bound session credentials (DBSCs) in Chrome?","acceptedAnswer":{"@type":"Answer","text":"Device-bound session credentials are a Chrome security feature that binds session cookies to a unique encryption key stored in device hardware, such as a Windows TPM or a macOS/iOS secure enclave. This prevents stolen session cookies from being used on a different device, since the cookie's validity depends on the hardware-resident key that cannot be copied elsewhere. Recently released versions of Chrome for Windows and macOS generate this key. Teams hardening authentication flows track browser security changes like DBSCs on daily.dev."}},{"@type":"Question","name":"How do attackers bypass 2FA and passkeys using session cookie theft?","acceptedAnswer":{"@type":"Answer","text":"Attackers use infostealer malware and adversary-in-the-middle phishing attacks to steal session cookies from a victim's browser, then paste those cookies into their own browser to gain the same authenticated access as the rightful owner. Because the session cookie already proves a completed login, this bypasses 2FA and passkey protections that only guard the initial authentication step, not the session token that follows. Anyone investigating account takeover techniques can follow session security developments on daily.dev."}}]} ```