LmCast :: Stay tuned in

Google Chrome adds session cookie theft protection for all users

Recorded: May 29, 2026, 1:01 p.m.

Original Summarized

Google Chrome adds session cookie theft protection for all users

News

Featured
Latest

Glassworm botnet disrupted after resilient C2 infrastructure takedown

CISA gives feds 4 days to patch actively exploited cPanel plugin flaw

Windows 11 KB5089573 update released with performance improvements

Charter confirms data breach after ShinyHunters extortion threat

Google Chrome adds session cookie theft protection for all users

Learn to hack, build security tools, and more for $70 in this course deal

Man sent to prison for selling data of 7 millions elderly Americans

US charges Google security engineer with Polymarket insider trading

Tutorials

Latest
Popular

How to access the Dark Web using the Tor Browser

How to enable Kernel-mode Hardware-enforced Stack Protection in Windows 11

How to use the Windows Registry Editor

How to backup and restore the Windows Registry

How to start Windows in Safe Mode

How to remove a Trojan, Virus, Worm, or other Malware

How to show hidden files in Windows 7

How to see hidden files in Windows

Webinars
Downloads

Latest
Most Downloaded

Qualys BrowserCheck

STOPDecrypter

AuroraDecrypter

FilesLockerDecrypter

AdwCleaner

ComboFix

RKill

Junkware Removal Tool

Deals

Categories

eLearning

IT Certification Courses

Gear + Gadgets

Security

VPNs

Popular

Best VPNs

How to change IP address

Access the dark web safely

Best VPN for YouTube

Forums
More

Virus Removal Guides
Startup Database
Uninstall Database
Glossary
Send us a Tip!
Welcome Guide

HomeNewsSecurityGoogle Chrome adds session cookie theft protection for all users

Google Chrome adds session cookie theft protection for all users

By Sergiu Gatlan

May 29, 2026
08:08 AM
0

Google says the Chrome Device Bound Session Credentials (DBSC) security feature is now generally available and is rolling out to all users to prevent account takeovers.
Available in beta since April, DBSC was first announced in 2024 as a way to cryptographically bind session cookies to a specific device, preventing hackers from using such stolen cookies to bypass multi-factor authentication (MFA) and hijack users' accounts.
DBSC works by cryptographically linking user sessions to the hardware, such as their computer's security chip (e.g., the Trusted Platform Module (TPM) on Windows and the Secure Enclave on macOS).
Since the unique public/private keys used to encrypt and decrypt sensitive data are generated by the security chip, they cannot be stolen, preventing attackers from using stolen session cookies.
"DBSC fundamentally changes the web's capability to defend against this threat by shifting the paradigm from reactive detection to proactive prevention, ensuring that successfully exfiltrated cookies cannot be used to access users' accounts," Google said in April.
"DBSC strengthens account security after users are logged in and helps bind a session cookie — small files used by websites to remember user information — to the device a user authenticated from. Even if malware was present on the user's device, DBSC reduces the risk of session theft and makes it meaningfully more difficult for malicious actors to exploit stolen session cookies," it added this week.

How DBSC works (Google)
​The feature is now rolling out to all Google Workspace customers, Workspace Individual subscribers, and users with personal Google accounts.
Google added that it will be enabled by default for all Google Workspace customers upon rollout and that administrators cannot disable it.
In the past, threat actors have abused the undocumented Google OAuth "MultiLogin" API endpoint to generate new authentication cookies after stolen ones expired.
The Lumma and Rhadamanthys information-stealing malware operations have also claimed that they could restore expired Google authentication cookies stolen in attacks to gain access to infected users' Google accounts.
At the time, Google advised customers to remove malware from their devices and recommended enabling Chrome's Enhanced Safe Browsing security mode to defend against phishing and malware attacks.
However, the new Chrome Device Bound Session Credentials (DBSC) security feature should effectively block malicious actors from abusing such stolen cookies, as they will not have access to the cryptographic keys required to use them.

The Validation Gap: Automated Pentesting Answers One Question. You Need Six.

Automated pentesting tools deliver real value, but they were built to answer one question: can an attacker move through the network? They were not built to test whether your controls block threats, your detection rules fire, or your cloud configs hold.This guide covers the 6 surfaces you actually need to validate.
Download Now

Related Articles:
Google Chrome adds infostealer protection against session cookie theftGoogle fixes fourth Chrome zero-day exploited in attacks in 2026Google now offers up to $1.5 million for some Android exploitsUS charges Google security engineer with Polymarket insider tradingLaravel Lang packages hijacked to deploy credential-stealing malware

Cookie
Cookies
DBSC
Device Bound Session Credentials
Google
Google Chrome
Infostealer
Web Browser

Sergiu Gatlan
Sergiu is a news reporter who has covered the latest cybersecurity and technology developments for over a decade. Email or Twitter DMs for tips.

Previous Article

Post a Comment Community Rules

You need to login in order to post a comment

Not a member yet? Register Now

You may also like:

  Upcoming Webinar

Popular Stories

Charter confirms data breach after ShinyHunters extortion threat

Microsoft Defender can now automatically isolate hacked endpoints

Windows 11 KB5089573 update released with performance improvements

Sponsor Posts

#1 MSP Benchmark report 2026: Insights from 1,000+ MSPs on growth, security, artificial intelligence, and key 2026 trends.

AI is a data-breach time bomb: Read the new report

Overdue a password health-check? Audit your Active Directory for free

Protect Your Business from Ecommerce Fraud

  Upcoming Webinar

Follow us:

Main Sections

News
Webinars
VPN Buyer Guides
SysAdmin Software Guides
Downloads
Virus Removal Guides
Tutorials
Startup Database
Uninstall Database
Glossary

Community

Forums
Forum Rules
Chat

Useful Resources

Welcome Guide
Sitemap

Company

About BleepingComputer
Contact Us
Send us a Tip!
Advertising
Write for BleepingComputer
Social & Feeds
Changelog

Terms of Use - Privacy Policy - Ethics Statement - Affiliate Disclosure

Copyright @ 2003 - 2026 Bleeping Computer® LLC - All Rights Reserved

Login

Username

Password

Remember Me

Sign in anonymously

Sign in with Twitter

Not a member yet? Register Now


Reporter

Help us understand the problem. What is going on with this comment?

Spam

Abusive or Harmful

Inappropriate content

Strong language

Other

Read our posting guidelinese to learn what content is prohibited.

Submitting...
SUBMIT

Google is rolling out the Chrome Device Bound Session Credentials (DBSC) security feature to protect all users from session cookie theft and account takeovers. DBSC was introduced in 2024 as a mechanism to cryptographically bind user sessions to the specific hardware device from which they originate, utilizing security chips such as the Trusted Platform Module (TPM) on Windows or the Secure Enclave on macOS. This binding process ensures that the unique public and private keys used for encrypting and decrypting sensitive data are generated and stored within the security chip, making them inaccessible to attackers even if session cookies are exfiltrated.

The implementation of DBSC fundamentally shifts the security paradigm from reactive detection to proactive prevention regarding session hijacking. By linking session cookies, which are small files websites use to remember user information, directly to the authenticated device, the feature significantly reduces the risk associated with session theft. Even in scenarios where malware is present on a user's device, DBSC makes it substantially more difficult for malicious actors to exploit stolen cookies to bypass multi-factor authentication or hijack user accounts.

Previous threat actors had exploited vulnerabilities, such as the undocumented Google OAuth MultiLogin API endpoint, to generate new authentication cookies after older ones had expired. Furthermore, information-stealing malware, including Lumma and Rhadamanthys, had demonstrated the ability to restore expired Google authentication cookies stolen during attacks to gain access to infected user accounts. The introduction of DBSC is designed to effectively block malicious actors from abusing these stolen credentials because they will lack access to the necessary cryptographic keys held by the hardware security chip.

This new feature is being rolled out to all Google Workspace customers, Workspace Individual subscribers, and users with personal Google accounts. Google has mandated that DBSC will be enabled by default for all Google Workspace customers and cannot be disabled by administrators. The feature strengthens account security immediately following a user login by ensuring that session cookies are securely tethered to the authenticating device. This development is presented by Sergiu Gatlan, who has covered cybersecurity and technology developments.