---
title: "Google Chrome adds session cookie theft protection for all users"
url: https://daily.dev/posts/google-chrome-adds-session-cookie-theft-protection-for-all-users-hmsdzdl44
source_url: https://www.bleepingcomputer.com/news/security/google-chrome-adds-session-cookie-theft-protection-for-all-users
type: article
source: "BleepingComputer"
published: 2026-05-29T12:12:41.624Z
updated: 2026-05-29T16:34:35.674Z
tags: ["authentication", "malware", "google-chrome"]
reading_time: 3
upvotes: 36
comments: 10
language: en
---

> ## Documentation Index
> Fetch the complete documentation index at: https://daily.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Google Chrome adds session cookie theft protection for all users

**[BleepingComputer](https://daily.dev/sources/bleepingcomputer)** · 3 min read · 36 upvotes · 10 comments

## Summary

Google has made Device Bound Session Credentials (DBSC) generally available in Chrome for all users. DBSC cryptographically binds session cookies to a specific device's hardware security chip (TPM on Windows, Secure Enclave on macOS), making stolen cookies useless to attackers since they lack the required private keys. The feature rolls out automatically to all Google Workspace customers, Workspace Individual subscribers, and personal Google account users, and cannot be disabled by administrators. This directly counters infostealer malware like Lumma and Rhadamanthys that previously exploited stolen or revived session cookies to bypass MFA and hijack accounts.

## Full article

daily.dev links to this article rather than hosting it. Read it at the original source: <https://www.bleepingcomputer.com/news/security/google-chrome-adds-session-cookie-theft-protection-for-all-users>

## Community discussion

Top comments from developers on daily.dev.

**@mavros\_lykos** · 4 upvotes

> meanwile fellow hackers : "Its time to exploit this too.."

**@allinonetools** · 4 upvotes

> This is a big win. I've seen too many account takeovers happen from stolen session cookies, so tying them to the actual device makes those stolen cookies useless even if attackers get hold of them.

**@tranduc01** · 3 upvotes

> ![GIF](https://static.klipy.com/ii/d6b0ce929193df3c242ac34b5654d2ce/5b/5f/5eEK9S81.gif)

**@ilijaveselinovic** · 1 upvotes

> Great improvement!

**@astafofo** · 1 upvotes

> Finally tackling stolen cookies at the hardware level

## Similar posts on daily.dev

- [Chrome adopts what may be the best protection yet against account takeovers](https://daily.dev/posts/chrome-adopts-what-may-be-the-best-protection-yet-against-account-takeovers-8zoybvphu) · Ars Technica · 5 upvotes · 0 comments

---

Tags: [#authentication](https://daily.dev/tags/authentication), [#malware](https://daily.dev/tags/malware), [#google-chrome](https://daily.dev/tags/google-chrome)

[View this post on daily.dev](https://daily.dev/posts/google-chrome-adds-session-cookie-theft-protection-for-all-users-hmsdzdl44)