The Chrome Device Bound Session Credentials (DBSC) feature cryptographically links user session cookies to the hardware security module of the device where the user authenticated, such as TPM or Secure Enclave. This binding ensures that even if session cookies are stolen, attackers cannot use them without access to the device's cryptographic keys, effectively preventing session cookie theft-based account takeovers. DBSC shifts the security model from reactive detection to proactive prevention and is enabled by default for all Google Workspace customers and rolling out to all users. This feature mitigates abuse of stolen or expired Google authentication cookies previously exploited by malware and threat actors. It is designed to strengthen account security post-login and reduce risks from malware presence on user devices.

The impact of DBSC is a reduction in the risk of account takeovers via stolen session cookies, which have historically been abused to bypass multi-factor authentication and hijack user accounts. By cryptographically binding session cookies to a device's hardware security module, attackers cannot reuse stolen cookies on other devices. This mitigates threats from malware and information-stealing operations that restore or reuse expired authentication cookies. No known exploits are currently reported in the wild, indicating the feature is effective at preventing this attack vector.

DBSC is enabled by default for all Google Workspace customers and rolling out to personal Google accounts and Workspace Individual subscribers. Administrators cannot disable this feature. Users and organizations should ensure they are running updated versions of Google Chrome to benefit from this protection. No additional user action is required to enable DBSC. Google recommends continuing to remove malware from devices and using Chrome's Enhanced Safe Browsing mode for broader phishing and malware protection. Patch status is not applicable as this is a new security feature rollout rather than a vulnerability patch.