Chrome 146 DBSC technology blocks 94% of cookie theft attempts, protecting 3.4B users after infostealers harvested 3.9 billion passwords from 4.3 million devices in 2024.

94% Cookie Theft Blocked: Chrome 146 DBSC Guards 3.4B Users

by
💡 Key Takeaways

  • Google Chrome 146 deploys DBSC (Device Bound Session Credentials) using TPM hardware, blocking 94% of cookie theft attempts in controlled testing — 85% of Windows Chrome installations are immediately protected.
  • Infostealer malware stole 3.9 billion passwords from 4.3 million devices in 2024, with another 1.8 billion credentials compromised in the first half of 2025 alone — an 800% surge.
  • DBSC cryptographically binds session cookies to device hardware, rendering stolen cookies useless — built as a W3C open standard co-designed with Microsoft.

3.9 billion. That is the number of passwords infostealer malware extracted from 4.3 million devices worldwide in 2024. Cookie theft is no longer a peripheral nuisance — it has become the backbone of the modern cybercrime economy.

On April 9, 2026, Google shipped a direct countermeasure inside Chrome 146. DBSC — Device Bound Session Credentials — cryptographically locks session cookies to the hardware they were created on. In controlled environments, the technology blocked 94% of cookie theft attempts.

For Chrome’s 3.45 billion users, this is not an incremental security patch. It is a structural change to how browsers handle authentication, one that could fundamentally disrupt the economics of credential theft.

Chrome browser cookie theft protection concept illustration
DBSC binds session cookies to hardware security chips, upending the economics of infostealer malware — Generated by OpenAI DALL-E 3

The Infostealer Epidemic: 3.9 Billion Passwords Gone

The scale of credential theft has entered a new phase. In 2024, infostealer malware compromised 4.3 million devices and extracted 3.9 billion passwords. The top three infostealer families — LummaC2, RedLine, and StealC — accounted for more than 75% of all infections.

The takeaway: this is not slowing down. In the first half of 2025, 5.8 million additional devices were infected, yielding 1.8 billion stolen credentials. That represents an 800% increase over the preceding six months.

What makes cookie theft particularly dangerous is volume and utility. Each infected device yielded an average of 1,861 cookies, according to SpyCloud and Recorded Future data. Verizon’s 2025 Data Breach Investigations Report found that 88% of breaches involved stolen credentials — making cookies the single most valuable commodity in the cybercriminal supply chain.

The barrier to entry has collapsed as well. MaaS (Malware-as-a-Service) subscriptions for infostealer tools start at just $250 per month, allowing low-skill operators to harvest credentials at industrial scale. The key here is the democratization of sophisticated attack tools — this is no longer a game reserved for nation-state actors or elite hacking groups.

Key point: 3.9 billion passwords stolen in 2024, 1.8 billion more in H1 2025 (800% surge). With 88% of breaches involving stolen credentials and MaaS subscriptions starting at $250/month, credential theft has become industrialized.

What DBSC Actually Does: Binding Cookies to Hardware

Device Bound Session Credentials operates on a straightforward principle: tie every session cookie to the physical device that created it. On Windows, DBSC leverages the TPM 2.0 (Trusted Platform Module) chip. On macOS, it will use Apple’s Secure Enclave.

The mechanism works like this. When a user authenticates with a website, Chrome generates a unique ECDSA (Elliptic Curve Digital Signature Algorithm) key pair inside the device’s security hardware. The private key never leaves the chip — it cannot be exported, copied, or transferred to another device.

Before issuing a new session cookie, the server requires Chrome to prove possession of the private key through a cryptographic challenge. Put simply, stolen cookies expire rapidly and cannot be renewed without the original device’s hardware key. The attacker gets a cookie, but the cookie dies before it is useful.

Keys rotate automatically every 30 days, and each session uses its own distinct key pair. This design ensures that even if one session is somehow compromised, the damage cannot cascade to other sessions on the same device.

In simpler terms: Traditional session cookies are like house keys that can be duplicated — steal a copy, walk right in. DBSC cookies are keys welded to a specific lock inside your device. Even if someone photographs your key, they cannot use it on a different machine.
Digital security lock
DBSC binds session cookies to hardware security modules, making stolen cookies immediately worthless to attackers — Photo by FlyD on Unsplash

94% Blocked: What the Test Results Show

In controlled testing environments, Chrome 146’s DBSC blocked 94% of attempted cookie theft scenarios. The remaining 6% occurred on older devices lacking compatible security hardware — on DBSC-capable machines, the block rate approached total protection.

Google also conducted a year-long internal deployment across its own services before the public rollout. The company reported a “significant reduction in session theft” for sessions protected by DBSC during that period. That internal validation became the basis for including DBSC in Chrome 146 as a general availability feature.

Why this matters: under the old model, a stolen session cookie gave attackers complete control over a victim’s active session — no password required, no two-factor authentication prompted. DBSC changes that equation entirely. Even if an attacker intercepts the cookie, the short-lived credential expires quickly and cannot be renewed without the device’s private key.

In short, DBSC does not just raise the difficulty of cookie theft. It attacks the economics — making stolen cookies a depreciating asset that loses value within minutes.

💡 Related Posts
$100M AI Security Alliance: The Two Faces of the Classified Model That Found a 27-Year-Old Bug

Coverage: 85% of Windows Chrome, macOS Next

DBSC is available immediately on Windows 10 version 1903 and later, plus all Windows 11 systems. This covers approximately 85% of active Windows Chrome installations — any device with a TPM 2.0 chip or Windows Hello-compatible security hardware qualifies.

Chrome holds a commanding position to deploy this at scale. The browser serves 3.45 billion users worldwide with a 64.86% global market share as of March 2026. With 85% of Windows installations immediately protected, the addressable impact spans billions of devices.

The scale is significant for a specific reason. Because Chrome dominates the browser landscape, DBSC adoption by major websites could happen faster than it would with a smaller browser. When the largest browser makes a security feature available to billions of users, web services have a strong economic incentive to support the standard on their backend.

macOS support via Apple’s Secure Enclave is scheduled for a subsequent Chrome release, and Linux support is also in development. For now, Windows users are the immediate beneficiaries. Cross-platform expansion will follow progressively, extending DBSC’s protective umbrella to the rest of Chrome’s user base.

Cybersecurity infrastructure
85% of Windows Chrome users gain immediate DBSC protection, with macOS and Linux expansion on the roadmap — Photo by GuerrillaBuzz on Unsplash

Privacy by Design: No Fingerprinting, No Tracking

Security upgrades that erode privacy are a recurring pattern in tech. DBSC was engineered to avoid that trap entirely. Each session generates a unique key pair, meaning even on the same device, different sessions cannot be linked or correlated.

The protocol transmits only the per-session public key to the server. It does not send device identifiers, attestation data, or any information that could be used for fingerprinting or cross-site tracking. Websites cannot repurpose DBSC as a surveillance mechanism — the architecture makes it structurally impossible.

DBSC was developed as an open standard through the W3C Web Application Security Working Group, with Microsoft co-designing the specification. The open-standard approach means DBSC is not a Chrome-exclusive feature. Other browsers can adopt it, creating the potential for an industry-wide shift in how session authentication works.

Key point: DBSC strengthens security without compromising privacy — no device identifiers are transmitted, and cross-site tracking is architecturally blocked. As a W3C open standard co-designed with Microsoft, it can be adopted by any browser.

Server-Side Requirements: What Websites Need to Do

DBSC protection requires action from both sides. Websites must add dedicated registration and refresh endpoints to their backends — the server needs to verify the browser’s proof of key possession before issuing fresh cookies.

No frontend code changes are needed. Chrome handles the cryptographic operations and cookie rotation transparently in the background, shielding developers from the complexity of the underlying protocol.

Three major server frameworks already offer official support: Node.js, Python Django, and ASP.NET Core. Enterprise security integration has also been validated, with compatibility confirmed for CrowdStrike Falcon and Microsoft Defender for Endpoint.

Okta, one of the largest identity management platforms, participated in DBSC’s Origin Trial and provided direct feedback to Google during the development process. The involvement of a major authentication provider signals that DBSC is not just a browser feature — it is positioning itself as enterprise authentication infrastructure.

For enterprises running distributed workforces, the implications are direct. Session hijacking has been one of the most reliable ways to bypass corporate security perimeters — an attacker with a stolen session cookie could access internal tools without triggering multi-factor authentication. DBSC closes that gap at the browser level, reducing one of the most exploited vectors in corporate breach scenarios.

💡 Related Posts
$30,000 Chip Price Shock: TSMC’s 4-Year Streak Ends the Era of Cheap Silicon

What Remains: TPM Gaps, Federation, and the Road Ahead

The most significant limitation is hardware dependency. DBSC does not work on older devices without TPM 2.0 or Secure Enclave. That 15% of Windows Chrome installations without compatible hardware represents a meaningful gap — and Google is exploring software-based key alternatives to address it.

The roadmap includes federated identity support through cross-origin bindings, as well as integration with mTLS and hardware security keys. The vision extends beyond cookie protection to binding the entire authentication chain to device hardware.

Kaspersky’s data shows infostealer detections rose 59% year-over-year, confirming that attacker tooling continues to evolve. DBSC’s expansion across Chrome’s ecosystem would fundamentally degrade the value of stolen cookies — but only if adoption reaches critical mass on both the browser and server sides.

Two metrics deserve close attention going forward: the timeline for macOS Secure Enclave support in the next Chrome release, and the pace at which the W3C standard gains adoption in competing browsers. If Firefox and Edge implement DBSC, the cookie theft economy faces an existential compression. If Chrome remains the sole adopter, the protection — while significant — stays fragmented.

References

Stay Ahead of the Curve

Get the latest insights on AI, tech, and markets — delivered in both Korean and English.

Explore More Posts