Google has introduced a new security feature in its Chrome browser called device-bound session credentials to prevent unauthorized account access.
This update aims to secure users in Saudi Arabia and the wider Gulf region against sophisticated digital threats. According to a report by Ars Technica, this technology addresses a critical vulnerability in modern web authentication.
Protection Against Cookie Theft
Many websites use session cookies to keep users logged in without requiring passwords constantly. However, cybercriminals increasingly use infostealer malware to steal these cookies and bypass multi-factor authentication. This type of attack allows unauthorized users to access sensitive accounts from different devices. Consequently, securing these temporary files has become a major priority for developers working in cybersecurity.
How Session Credentials Work
The new system ensures that session credentials remain locked to a specific physical device.
The browser generates unique session credentials that are stored directly in the hardware security module of the computer. On Windows devices, this module is the Trusted Platform Module (TPM), while macOS and iOS devices use the Secure Enclave.
“The attacker can’t steal the private key from the device because the TPM / Secure Enclave will not release it. That is the core protection here.”
Scott Helme, Security Researcher
When a website requests verification, the browser signs the session cookie using the hardware-bound key. Web servers then verify this signature against the public key stored on their systems. If an attacker steals the cookie, they cannot sign the authentication challenge without physical access to the device. This mechanism significantly reduces the success rate of phishing and adversary-in-the-middle attacks.
Current Testing and Availability
Currently, Google is testing this feature in specific versions of its browser. It is available in Chrome version 147 for Windows and version 150 for macOS. However, the feature is only active for a limited group of users during this initial phase. Users can check if the protection is active by opening the developer tools in their apps and looking under the application tab.
Future Security Standards
This hardware-bound approach represents a shift away from shared secrets like traditional passwords. Similar to passkeys, this technology relies on public-key cryptography to verify user identity. While it is currently limited to Chrome, other Chromium-based browsers may adopt similar measures in the future. This development could establish a new baseline for user protection across various smart devices.
