
Chrome Adds Hardware-Backed Session Keys to Thwart Cookie Theft on Windows
Google rolled out Device Bound Session Credentials (DBSC) in Chrome 146 for Windows, tying authentication sessions to hardware-backed keys (TPM on Windows, with macOS Secure Enclave support planned) so stolen cookies become useless; if a device lacks secure key storage, DBSC gracefully falls back to normal behavior. Early results show reduced session theft, and Google plans broader device support and enterprise integration while preserving privacy and avoiding cross-site tracking.






