{"id":559,"date":"2026-04-10T08:49:01","date_gmt":"2026-04-10T08:49:01","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=559"},"modified":"2026-04-10T08:49:01","modified_gmt":"2026-04-10T08:49:01","slug":"google-rolls-out-dbsc-in-chrome-146-to-block-session-theft-on-windows","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=559","title":{"rendered":"Google Rolls Out DBSC in Chrome 146 to Block Session Theft on Windows"},"content":{"rendered":"
\n

\ue804<\/i>Ravie Lakshmanan<\/span>\ue802<\/i>Apr 10, 2026<\/span><\/span>Malware \/ Browser Security<\/span><\/p>\n<\/div>\n

\n
<\/a><\/div>\n

Google has\u00a0made Device Bound Session Credentials<\/strong>\u00a0(DBSC) generally available to all Windows users of its Chrome web browser, months after\u00a0it began\u00a0testing the security feature in open\u00a0beta.<\/p>\n

The public availability is currently limited to Windows users on Chrome 146, with macOS expansion planned in an upcoming Chrome\u00a0release.<\/p>\n

\u00abThis project represents a significant step forward in our ongoing efforts to combat session theft, which remains a prevalent threat in the modern security landscape,\u00bb Google’s Chrome and Account Security\u00a0teams said<\/a> in a Thursday\u00a0post.<\/p>\n

Session theft involves the covert exfiltration of session cookies from the web browser, either by gathering existing ones or waiting for a victim to log in to an account, to an attacker-controlled\u00a0server.<\/p>\n

\n
\"Cybersecurity\"<\/a><\/div>\n<\/div>\n

Typically, this happens when users inadvertently download information-stealing malware into their systems. These\u00a0stealer malware families \u2013 of which there are many, such as Atomic, Lumma, and Vidar Stealer \u2013 come with capabilities to harvest a wide range of information from compromised systems, including\u00a0cookies.<\/p>\n

Because session cookies often have extended lifespans, attackers can leverage them to gain unauthorized access to victims’ online accounts without having to know their passwords. Once\u00a0collected, these tokens are packaged and sold to other threat actors for financial gain. Cybercriminals who acquire them can follow up with their attacks of their\u00a0own.<\/p>\n

DBSC,\u00a0first announced by Google in April 2024, aims to counter this abuse by cryptographically tying the authentication session to a specific device. In\u00a0doing so, the idea is to render cookies worthless even if they get stolen by\u00a0malware.<\/p>\n

\"\"<\/a><\/div>\n

\u00abIt does this using hardware-backed security modules, such as the Trusted Platform Module (TPM) on Windows and the Secure Enclave on macOS, to generate a unique public\/private key pair that cannot be exported from the machine,\u00bb Google explained.<\/p>\n

\u00abThe issuance of new short-lived session cookies is contingent upon Chrome proving possession of the corresponding private key to the server. Because attackers cannot steal this key, any exfiltrated cookies quickly expire and become useless to those attackers.\u00bb<\/p>\n

In the event a user’s device does not support secure key storage, DBSC gracefully falls back to standard behavior without breaking the authentication flow,\u00a0Google said<\/a> in its developer documentation.<\/p>\n

\n
\"Cybersecurity\"<\/a><\/div>\n<\/div>\n

The tech giant said it has observed a significant reduction in session theft since its launch, an early indication of the success of the countermeasure. The\u00a0official launch is just the start, as the company plans to bring DBSC to a broader range of devices and introduce advanced capabilities to better integrate with enterprise environments.<\/p>\n

Google, which worked with Microsoft to design the\u00a0standard with an aim\u00a0to make it an open web standard, also emphasized that the DBSC architecture is private by design and that the distinct key approach ensures that websites cannot use the session credentials to correlate a user’s activity across different sessions or sites on the same\u00a0device.<\/p>\n

\u00abFurthermore, the protocol is designed to be lean: it does not leak device identifiers or attestation data to the server beyond the per-session public key required to certify proof of possession,\u00bb it added. \u00abThis minimal information exchange ensures DBSC helps secure sessions without enabling cross-site tracking or acting as a device fingerprinting mechanism.\u00bb<\/p>\n<\/div>\n","protected":false},"excerpt":{"rendered":"

\ue804Ravie Lakshmanan\ue802Apr 10, 2026Malware \/ Browser Security Google has\u00a0made Device Bound Session Credentials\u00a0(DBSC) generally available to all Windows users of its Chrome web browser, months after\u00a0it began\u00a0testing the security feature…<\/p>\n","protected":false},"author":1,"featured_media":560,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[1009,182,1160,2,1159,1161,526,307],"class_list":["post-559","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-uncategorized","tag-block","tag-chrome","tag-dbsc","tag-google","tag-rolls","tag-session","tag-theft","tag-windows"],"_links":{"self":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts\/559","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=559"}],"version-history":[{"count":0,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts\/559\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/media\/560"}],"wp:attachment":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=559"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=559"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=559"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}