Chrome adopts what may be the best protection yet against account takeovers

Google has begun rolling out Device‑Bound Session Cookies (DBSCs) in the latest Chrome builds—version 147 for Windows users and version 150 for macOS. The feature leverages the TPM on PCs and the Secure Enclave on Apple devices to store a private signing key that never leaves the chip. When a site that opts‑in receives a session cookie, it issues a challenge that must be signed with this key; the server validates the signature against the public key it previously recorded. Researchers like Scott Helme of Report URI note that while an adversary can still exfiltrate the cookie, they cannot produce the required cryptographic response without the hardware‑protected key, effectively neutralizing classic session‑hijacking attacks.

The move extends the same “passkey” philosophy that underpins WebAuthn, shifting authentication away from shared secrets toward asymmetric cryptography. By embedding the private key in platform‑level hardware, Google sidesteps the long‑standing weakness of cookies that can be replayed on any device. This aligns Chrome with Apple’s Secure Enclave‑based protections and mirrors Microsoft’s push for hardware‑rooted identity in Windows Hello. Although the rollout is limited to a subset of users for now, the architecture is baked into Chromium, suggesting that other browsers built on the same engine—Edge, Brave, Vivaldi—could adopt DBSCs without major code rewrites, potentially raising the baseline security of the entire web ecosystem.

What follows will be a test of adoption speed and server‑side readiness. Web developers must update authentication back‑ends to store public keys and validate DBSC challenges, a step that may be skipped if the perceived threat is low. Meanwhile, attackers may pivot toward phishing for the private key’s signing request or target devices lacking TPM/Enclave support. Watch for Chrome’s telemetry on DBSC usage, announcements of broader rollouts, and any early reports of compatibility issues with legacy sites that rely on cookie‑only sessions.