Androidauthority

Google Chrome Enhances Security with Device Bound Session Credentials

First seen 29 May 2026, 17:14 UTC • •30.9

Article Content

1 / 10

Browse articles

ThreatCluster •May 30, 2026 at 16:54 UTC

•DBSC binds session cookies to the device, enhancing security against theft.
•The feature is enabled by default for all users, including Google Workspace customers.
•Rollout began on May 25, 2026, and will complete within 60 days.

Google has rolled out its Device Bound Session Credentials (DBSC) feature for Chrome, aimed at preventing session cookie theft. This feature cryptographically binds session cookies to the user's device, making it significantly harder for attackers to exploit stolen cookies. Initially available in beta, DBSC is now enabled by default for all Google Workspace and personal account users on Windows. The rollout began on May 25, 2026, and is expected to complete within 60 days. This enhancement addresses past vulnerabilities where attackers could exploit stolen cookies to bypass multi-factor authentication. Google has previously warned users about malware that could restore expired authentication cookies, emphasizing the importance of this new feature. The DBSC implementation is a proactive measure to enhance account security against session hijacking threats.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 103d ago How this analysis works

Timeline

2024-01-01

DBSC announced

Google first announced the Device Bound Session Credentials feature as a security enhancement for Chrome.

BleepingComputer

2026-04-01

DBSC enters beta testing

The DBSC feature was made available in beta for select users, focusing on improving session security.

BleepingComputer

2026-05-25

DBSC rollout begins

Google started the general rollout of the DBSC feature to all users, enhancing Chrome's security.

AndroidAuthority

2026-05-30

DBSC officially available

Google confirmed that DBSC is now generally available, providing robust protection against session hijacking.

Cybersecuritynews

More articles in this cluster (9)

Threat Graph

12 entities, 11 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Technique (4)

Malware
Phishing
T1041 - Exfiltration Over C2 Channel
T1566 - Phishing

Malware (2)

Lumma
Rhadamanthys

Affected Platform (3)

MacOS
Windows
NuGet

Threat Actor (1)

The Gentlemen

Tool (2)

Google Chrome
MultiLogin

Relationships

The Gentlemen uses Lumma
The Gentlemen uses Rhadamanthys
The Gentlemen uses Google Chrome
The Gentlemen uses MultiLogin
The Gentlemen uses Malware
The Gentlemen uses Phishing
The Gentlemen uses T1041 - Exfiltration Over C2 Channel
The Gentlemen uses T1566 - Phishing
The Gentlemen related to MacOS
The Gentlemen related to Windows
The Gentlemen related to NuGet

Following this threat?

Track The Gentlemen and Lumma in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Continue Reading

Healthcare Cyberattacks Disrupt Patient Care and Expose Sensitive Data Two major healthcare companies, Boston Scientific and Nutex Health, reported cyberattacks that compromised patient data and disrupted operations. Boston Scientific's systems were breached on August 25, affecting the functionality of pacemakers and other heart devices, preventing remote monitoring. The company is…

Multiple Ransomware Attacks Target Diverse Industries in September 2026 In early September 2026, several ransomware groups executed attacks on various organizations, including Krybit's assault on Reignwood Park Thailand and Arab Maritime Petroleum Transport Company, Everest's attack on VIVOTEK, and Settra's targeting of Golden Neo Life. These incidents involved threats to leak sensitive…