Androidauthority

Google Chrome Enhances Security with Device Bound Session Credentials

First seen 29 May 2026, 17:14 UTC • •30.9

Article Content

1 / 10

Browse articles

ThreatCluster •May 30, 2026 at 16:54 UTC

•DBSC binds session cookies to the device, enhancing security against theft.
•The feature is enabled by default for all users, including Google Workspace customers.
•Rollout began on May 25, 2026, and will complete within 60 days.

Google has rolled out its Device Bound Session Credentials (DBSC) feature for Chrome, aimed at preventing session cookie theft. This feature cryptographically binds session cookies to the user's device, making it significantly harder for attackers to exploit stolen cookies. Initially available in beta, DBSC is now enabled by default for all Google Workspace and personal account users on Windows. The rollout began on May 25, 2026, and is expected to complete within 60 days. This enhancement addresses past vulnerabilities where attackers could exploit stolen cookies to bypass multi-factor authentication. Google has previously warned users about malware that could restore expired authentication cookies, emphasizing the importance of this new feature. The DBSC implementation is a proactive measure to enhance account security against session hijacking threats.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Answers cite the sources they use

Updated 149d ago How this analysis works

Timeline

2024-01-01

DBSC announced

Google first announced the Device Bound Session Credentials feature as a security enhancement for Chrome.

BleepingComputer

2026-04-01

DBSC enters beta testing

The DBSC feature was made available in beta for select users, focusing on improving session security.

BleepingComputer

2026-05-25

DBSC rollout begins

Google started the general rollout of the DBSC feature to all users, enhancing Chrome's security.

AndroidAuthority

2026-05-30

DBSC officially available

Google confirmed that DBSC is now generally available, providing robust protection against session hijacking.

Cybersecuritynews

More articles in this cluster (9)

Threat Graph

4 entities, 2 inferred relationships (STIX 2.1).

The full threat graph for this incident is free in the 7-day Starter trial.

Create free account

No card · 30 seconds

See everything included

Technique (2)

Malware
Phishing

Affected Platform (1)

Windows

Tool (1)

Google Chrome

Relationships

Malware targets Windows
Phishing targets Windows

Continue Reading

Critical BeyondTrust 9.3 Vulnerability Actively Exploited by Threat Actor A critical vulnerability (CVE-2026-102764) in BeyondTrust Remote Support has been discovered and is actively being exploited by the threat group ARMORY CASTLE, reportedly linked to China. The vulnerability, which has a CVSS score of 9.3, allows unauthenticated attackers to upload files and potentially compromise host…

Lazarus APT Launches Operation FlashHole Using AI and Post-Quantum Cryptography Kaspersky has identified a cyberespionage campaign, dubbed Operation FlashHole, attributed to the Lazarus APT group, active since July 2025. The campaign has targeted at least three organizations in South Korea's construction, software, and wire-communication sectors. Attack methods include spear-phishing emails…