Chrome's new security feature could make stolen session cookies virtually useless

https://www.techspot.com/images2/news/ts3_thumbs/2026/08/2026-08-12-ts3_thumbs-9e8.jpg

Serving tech enthusiasts for over 25 years.
TechSpot means tech analysis and advice you can trust.

The takeaway: Chrome is beginning to use hardware-backed cryptographic keys to make stolen browser cookies harder to use. The feature, called device-bound session credentials, links an authenticated web session to the device where the user signed in.

The change targets a common method of account takeover. Attackers who obtain a browser session cookie can sometimes load it into another browser and gain access to an account without entering the victim's password or completing two-factor authentication. Device-bound session credentials are designed to stop that by requiring proof that the browser still has access to a private key stored on the original device.

Chrome creates that key during the session setup process and stores it in protected hardware. On Windows, that hardware is the Trusted Platform Module, or TPM. Apple devices use the Secure Enclave....

Copyright of this story solely belongs to techspot.com. To see the full text click HERE