Chrome Auto-Enables DBSC for 146+ Users to Block Cookie Theft
Updated
Updated · ZDNet · Jun 1
Chrome Auto-Enables DBSC for 146+ Users to Block Cookie Theft
2 articles · Updated · ZDNet · Jun 1
Google has begun automatically turning on Device Bound Session Credentials in Chrome for Windows, covering Google Workspace and personal Google accounts without any user or admin action.
DBSC ties session cookies to a device’s security hardware—typically a TPM on Windows or Secure Enclave on Macs—so stolen cookies cannot be reused on another machine.
The feature targets session hijacking attacks in which malware lifts browser cookies and lets attackers bypass multi-factor authentication by impersonating already logged-in users.
Chrome users need version 146 or later on Windows and 148 or later on Mac to get the protection, which Google started developing in 2024 and offered as a 2025 open beta for Workspace customers.
Can malware already on your PC bypass Google's new anti-theft feature to access your accounts?
Will Google's new security create a digital divide, leaving older devices more vulnerable to attack?
As Google ends the era of cookie theft, what new cyber threats will emerge to take its place?
Google’s Device Bound Session Credentials (DBSC): A Game-Changer Against Session Cookie Theft and APTs in 2026
Overview
As cyber threats grow more sophisticated, session cookie theft has become a major concern, allowing attackers to bypass even strong authentication methods and gain unauthorized access to accounts. In response, Google launched Device Bound Session Credentials (DBSC) on May 25, 2026, making it available to all Google Workspace and personal account users. DBSC combats session hijacking by binding session cookies to a specific device, so stolen cookies cannot be used elsewhere. This new security measure is being rolled out over 60 days, providing a crucial layer of protection against persistent threats and helping secure user accounts across the digital landscape.