Google Chrome rolls out a new tool to try and stop infostealer malware in its tracks

News
By published

New Google Chrome feature makes cookies useless on other computers

Google Chrome app is seen on an iPhone next to Edge and other web browser apps. Microsoft is using new prompts in Edge to try and stop users from downloading Chrome.
(Image credit: Tada Images / Shutterstock)
  • Google adds Device Bound Session Credentials to Chrome
  • DBSC ties session cookies to hardware keys, blocking theft
  • Feature live on Windows, macOS rollout coming soon

Google has rolled out a new Chrome browser feature which should make stealing session cookies for use in infostealer malware attacks a thing of the past.

Chrome 146 for Windows has introduced a new security feature called Device Bound Session Credentials (DBSC), which works by cryptographically binding authentication sessions to the physical device used to authenticate.

It does so through hardware-backed security modules (such as the Trusted Platform Module on Windows) to generate a unique public/private key pair that cannot be exported from the machine.

Article continues below

Why are cookies important?

“The issuance of new short-lived session cookies is contingent upon Chrome proving possession of the corresponding private key to the server,” Google explained in its announcement. “Because attackers cannot steal this key, any exfiltrated cookies quickly expire and become useless to those attackers.”

Google says the new feature will allow websites to upgrade to secure sessions by adding dedicated registration and refresh endpoints to their backend, while maintaining compatibility with the existing front-end.

Chrome will handle cryptography and cookie rotation, while the web app will continue using standard cookies for access, just as before. Right now, the search engine giant only released an upgrade for Windows, with the macOS variant rolling out in the coming weeks.

An early version of this protocol was rolled out in 2025, Google said, noting that for sessions protected by DBSC, it observed a “significant reduction” in session theft.

Ever since multi-factor authentication (MFA) became industry standard, browser session cookies have gotten extremely valuable. Since these cookies are generated post authentication, cybercriminals can effectively bypass this important authentication step and gain access to target accounts.

Hackers usually steal these cookies by using infostealing malware, trick ingtheir targets into downloading Lumma, Vidar, StealC, AMOS, or any other variant, capable of grabbing not only session cookies, but also stored passwords, cryptocurrency wallet data, contents of the clipboard, and more.

Best antivirus software header
The best antivirus for all budgets

➡️ Read our full guide to the best antivirus
1. Best overall:
Bitdefender Total Security
2. Best for families:
Norton 360 with LifeLock
3. Best for mobile:
McAfee Mobile Security

Follow TechRadar on Google News and add us as a preferred source to get our expert news, reviews, and opinion in your feeds. Make sure to click the Follow button!

And of course you can also follow TechRadar on TikTok for news, reviews, unboxings in video form, and get regular updates from us on WhatsApp too.

Sead Fadilpašić

Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.

You must confirm your public display name before commenting

Please logout and then login again, you will then be prompted to enter your display name.