As described in a new blog post from Google, the anti-theft feature Device Bound Session Credentials (DBSC) is now available in Chrome for Windows. Enabled by default for all Google Workspace and personal Google accounts, this one is geared for both consumer and enterprise Chrome users.

In a typical cookie-hijacking attack, a hacker uses certain malware to remotely steal your browser cookies. By extracting the passwords and other sensitive data from those cookies, they can sign in to your associated accounts on their own devices. And they can do this without having to grapple with any multi-factor authentication codes that would otherwise try to verify your identity.

With DBSC activated, your browser sessions and cookies are tied to your computer's built-in security chip. On most Windows PCs, this is the Trusted Platform Module (TPM). On a Mac, this is the Secure Enclave. Even if a hacker steals your browser cookies, they can't use them on their own devices since those cookies are still linked to your own computer and can't be applied elsewhere.

"DBSC strengthens account security after users are logged in and helps bind a session cookie -- small files used by websites to remember user information -- to the device a user authenticated from," Google explained in its blog post. "Even if malware was present on the user's device, DBSC reduces the risk of session theft and makes it meaningfully more difficult for malicious actors to exploit stolen session cookies."