Chrome Adds Device-Bound Credentials to Block Session Cookie Theft as 2FA Drives New Attacks
Updated
Updated · Ars Technica · Aug 11
Chrome Adds Device-Bound Credentials to Block Session Cookie Theft as 2FA Drives New Attacks
2 articles · Updated · Ars Technica · Aug 11
Summary
Recently released Chrome versions for Windows and macOS now generate device-bound session credentials, tying login sessions to hardware-stored keys so stolen cookies cannot be reused on another machine.
Session cookie theft has become a favored takeover method as 2FA, passkeys and similar protections blunt password-only phishing; attackers increasingly use infostealer malware and adversary-in-the-middle attacks instead.
TPMs on Windows and secure enclaves on Apple devices hold the unique encryption keys in silicon, giving websites a way to verify that an authenticated session remains on the original device.
The change targets a weak point in modern authentication: cookies that let users stay logged in across pages, but can also hand attackers temporary account access if copied.