Tag: session cookie theft

In Chrome 146 for Windows, Google introduced Device Bound Session Credentials (DBSC) protection, which prevents malware that steals information from collecting session cookies. This security enhancement will be available to macOS users in an upcoming, unannounced Chrome edition. The new protection, which was unveiled in 2024, operates by cryptographically connecting a user's session to their particular hardware, like as the Secure Enclave on macOS and the Trusted Platform Module (TPM) on Windows. Sensitive data cannot be exported from the computer because the security chip generates the unique public/private keys needed to encrypt and decrypt it. Because the system cannot export the unique private key that protects the stolen session data, the attacker is prevented from exploi...