Google has introduced Device-Bound Session Credentials (DBSC) to block malware from stealing session cookies and bypassing two-factor authentication.

This security update addresses a critical vulnerability used by infostealers to hijack active user sessions. By binding cookies to a specific device, Google aims to prevent attackers from using stolen credentials on different hardware to gain unauthorized account access.

The DBSC feature was initially launched in April 2024 [1]. While early deployment focused on Windows devices [2], the protection is now rolling out to all users across different platforms [3].

Infostealer malware typically targets session cookies, which are small files that keep a user logged into a website after they have provided their password and two-factor authentication code. If a hacker steals these cookies, they can impersonate the user without needing the original login credentials or the second-factor token.

Google's new system ensures that the session cookie is cryptographically bound to the hardware of the device that created it [3]. If a cookie is moved to a different machine, the server will recognize that the device does not match the credential and will deny access [3].

This shift moves the security burden from the user to the browser and the server. Previously, users relied on changing passwords, or clearing cookies, after a suspected breach. Now, the browser prevents the stolen cookie from being functional on any other device [3].

Industry reports indicate that this rollout is part of a broader effort to neutralize the effectiveness of session hijacking. By making cookie theft pointless, Google reduces the risk of account takeovers even when a device is infected with malware [3].

“Google has introduced Device-Bound Session Credentials (DBSC) to block malware from stealing session cookies.”

The implementation of DBSC represents a shift toward hardware-backed security for web sessions. By neutralizing the portability of session cookies, Google is effectively removing the primary incentive for infostealer malware to target these tokens, forcing attackers to find more complex ways to bypass two-factor authentication.