Your Chrome browser now has a new bodyguard against hackers

Google has started rolling out a Chrome feature aimed at a problem that’s become much harder to deal with as passwords and two-factor authentication get better. Device Bound Session Credentials, or DBSC, are designed to stop stolen session cookies from being used to take over an account.

For those who aren’t already aware, session cookies are what allow websites to remember that you’ve already signed in. After you log into Gmail or another service, the site can store a cookie in Chrome and use it to recognize you on subsequent visits. This is why you don’t have to enter your password every time, because the cookie acts as proof that authentication has already happened.

That also makes session cookies a useful target for malware.

An infostealer running on a computer can grab those cookies and send them to an attacker. The attacker can then load them into another browser and sometimes get the same access as the legitimate user, without needing the password or another authentication factor. It’s one reason browser security remains such a moving target, with Chrome recently fixing 41 security vulnerabilities in a single update.

DBSC changes what happens after the cookie is stolen.

Chrome generates a cryptographic key and stores the private portion in hardware designed to keep it isolated from the rest of the system. Windows PCs use the Trusted Platform Module, or TPM, while Apple devices use the Secure Enclave. The private key isn’t handed back to Chrome as readable data, which makes it much harder for malware to copy it along with the session cookie.

A website that supports DBSC can ask Chrome to prove that the session is still tied to the device where it was created. The browser signs that challenge using the private key, and the server can reject the session if that proof is missing.

Scott Helme, the security researcher and founder of Report URI who recently wrote about the feature, explained the basic idea to Ars Technica.

The attacker can steal the cookie, but they can’t answer a DBSC challenge by signing it with the private key, which is still safe on your device.

That leaves an attacker with the stolen cookie, but without the key needed to complete the authentication process.

Google has enabled DBSC by default for Workspace accounts and is gradually expanding the rollout to regular Chrome users on Windows and Mac. The feature isn’t available to everyone yet, and Google appears to be taking a staged approach rather than switching it on across the board.

For now, DBSC is another piece of Chrome’s broader security work. Google has also been blocking malware that tries to hijack the New Tab page and says Chrome now blocks more than 7 billion unwanted notification prompts each day.

The company is also winding down support for older, less secure extensions, with Manifest V2 extensions set to disappear from the Chrome Web Store at the end of the month.

DBSC isn’t going to prevent every type of account takeover, but it tackles one of the ways attackers can get around stronger login protections. A stolen cookie is considerably less useful when access also depends on a private key that never leaves the user’s device.

We stand out from the tech-media crowd because we break news stories; we mainly bring you stuff that you won’t find anywhere in the mainstream tech media. Our stories have been picked up by some of the world’s most popular websites and media outlets—more info is available here.