NewsPublished 29 May 2026

Google Chrome adds session cookie theft protection for all users

Source Bleeping Computer

Description

Google says the Chrome Device Bound Session Credentials (DBSC) security feature is now generally available and is rolling out to all users to prevent account takeovers. [...]

Impact

The impact of DBSC is a reduction in the risk of account takeovers via stolen session cookies, which have historically been abused to bypass multi-factor authentication and hijack user accounts. By cryptographically binding session cookies to a device's hardware security module, attackers cannot reuse stolen cookies on other devices. This mitigates threats from malware and information-stealing operations that restore or reuse expired authentication cookies. No known exploits are currently reported in the wild, indicating the feature is effective at preventing this attack vector.

Defensive guidance

DBSC is enabled by default for all Google Workspace customers and rolling out to personal Google accounts and Workspace Individual subscribers. Administrators cannot disable this feature. Users and organizations should ensure they are running updated versions of Google Chrome to benefit from this protection. No additional user action is required to enable DBSC. Google recommends continuing to remove malware from devices and using Chrome's Enhanced Safe Browsing mode for broader phishing and malware protection. Patch status is not applicable as this is a new security feature rollout rather than a vulnerability patch.

References

bleepingcomputer.com/news/security/google-chrome-adds-session-cookie-theft-protection-for-all-users/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 29 May 2026, 12:18 UTC

References

Community reviews