Google Chrome's New Cookie Theft Protection: What DBSC Means for Houston Businesses

Session cookie theft has become the primary way attackers bypass MFA. Here's how it works today:

1. User logs into Microsoft 365, Google Workspace, or any web application with MFA
2. The application issues a session cookie — a token that says "this user already authenticated"
3. Infostealer malware (or a compromised supply chain tool) copies that cookie from the browser
4. The attacker imports the stolen cookie into their own browser on a different machine
5. The application sees a valid session cookie and grants access — no MFA prompt, no password needed

This is why we've seen MFA bypassed in the Axios supply chain attack, the CPUID/STX RAT compromise, and thousands of business email compromise incidents. The attacker doesn't need your password or your MFA code — they just need the cookie.

DBSC uses your device's hardware security module — the TPM (Trusted Platform Module) on Windows or the Secure Enclave on macOS — to create a cryptographic binding between the session cookie and your physical device:

1. When you authenticate to a website, Chrome generates a unique public/private key pair using the TPM
2. The private key never leaves the TPM — it cannot be exported, copied, or stolen by malware
3. The server stores the public key and requires proof of possession of the private key with each session refresh
4. If someone steals the cookie and tries to use it on a different device, they can't prove possession of the private key — the session is rejected

Privacy by Design

Each DBSC session uses a distinct cryptographic key — websites can't correlate your activity across different sessions or sites. No device identifiers or attestation data are shared with the server. DBSC is not a fingerprinting mechanism.

---

The Good

• Infostealer malware becomes less effective: RedLine, Lumma, Vidar, and other infostealers that harvest browser cookies will find that stolen tokens don't work on attacker machines
• Supply chain attacks lose their MFA bypass: Even if a compromised tool steals your browser cookies (like the Axios or CPUID attacks), those cookies are cryptographically bound to your device and useless elsewhere
• BEC risk drops: Attackers who steal M365 session cookies to hijack email accounts will find device-bound sessions much harder to exploit

The Limitations

• Websites must adopt the standard: DBSC only works when the website/application implements it server-side. Google services support it now. Microsoft and other major providers are expected to follow, but it's not universal yet
• Windows only (for now): macOS support is coming in a subsequent Chrome release. No timeline for Linux
• Requires TPM 2.0: Most modern business PCs (2016+) have TPM 2.0. Older hardware may not support DBSC
• Doesn't stop on-device attacks: If the attacker has code running on your machine (keylogger, screen capture), DBSC doesn't help — they're already inside. DBSC prevents stolen cookies from being used elsewhere

Action Items for IT Teams

• Update Chrome to version 146+ across your managed fleet
• Verify TPM 2.0 is enabled on all business workstations: Get-Tpm in PowerShell
• Verify DBSC is active: Navigate to chrome://device-bound-session-credentials in Chrome
• Continue using FIDO2/passkeys for MFA — DBSC complements but doesn't replace phishing-resistant authentication
• Keep EDR active — DBSC prevents stolen cookies from working remotely, but you still need endpoint protection to prevent the malware that attempts the theft in the first place

---

DBSC is a powerful new layer, but it's one layer in a defense-in-depth stack:

Layer	What It Stops	Tool
Application allowlisting	Malware from executing at all	Privileged Access Management (PAM), WDAC
EDR	Malware that bypasses allowlisting	SentinelOne, CrowdStrike, Defender
Phishing-resistant MFA	Credential theft via phishing	FIDO2, passkeys
DBSC (Chrome 146+)	Stolen cookies used on other devices	Chrome + TPM 2.0
Conditional Access	Authentication from untrusted devices/locations	Entra ID, Okta

No single control stops everything. Together, they make your Houston business dramatically harder to compromise.

Need help deploying Chrome 146 and verifying DBSC across your fleet? Call 713-571-2390.

Related: Axios Supply Chain Attack | Privileged Access Management | Endpoint Security