{"id":45331,"date":"2026-04-12T03:56:23","date_gmt":"2026-04-11T19:56:23","guid":{"rendered":"https:\/\/nuoya.nuoyayasuo.top\/index.php\/2026\/04\/12\/google-chrome-update-disrupts-infostealer-cookie-theft\/"},"modified":"2026-04-12T03:56:23","modified_gmt":"2026-04-11T19:56:23","slug":"google-chrome-update-disrupts-infostealer-cookie-theft","status":"publish","type":"post","link":"https:\/\/nuoya.nuoyayasuo.top\/index.php\/2026\/04\/12\/google-chrome-update-disrupts-infostealer-cookie-theft\/","title":{"rendered":"Google Chrome Update Disrupts Infostealer Cookie Theft"},"content":{"rendered":"\n

Google has launched a new security feature for Chrome<\/a> on Windows to prevent session theft by hackers. This update, called Device Bound Session Credentials (DBSC), is now available for Chrome 146<\/a> users. It aims to solve a common problem where scammers use infostealer malware to steal session cookies from a computer. Cookies are basically small files that websites use to remember you, so you don\u2019t have to log in every time.<\/p>\n

Google\u2019s Chrome and Account Security teams noted in the official Google Security blog<\/a> that \u201csession theft typically occurs when a user inadvertently downloads malware onto their device.\u201d If a hacker steals these cookies, they can hijack your accounts without needing your password.<\/p>\n

Researchers explain that this \u201ccookie exfiltration\u201d is difficult to thwart because when malware like LummaC2<\/a> or Vidar<\/a> compromises a device, it can easily see the files and memory where the browser stores this information.<\/p>\n

\u201cDBSC fundamentally changes the web’s capability to defend against this threat by shifting the paradigm from reactive detection to proactive prevention, ensuring that successfully exfiltrated cookies cannot be used to access users\u2019 accounts,\u201d explained the Google Account Security team.<\/p>\n

How the new security works<\/strong><\/h3>\n

The new system addresses this issue by linking your login session directly to your computer using a special security chip inside your machine, known as the Trusted Platform Module (TPM) on Windows or the Secure Enclave on macOS<\/a>. The browser creates a unique public\/private key pair that stays on your computer and cannot be moved to another device.<\/p>\n

Now, when you use a website, Chrome has to prove it has that private key before the server will give it a new cookie<\/a>. These cookies are also short-lived, which is an important feature because a hacker cannot steal the key from your hardware; any cookies they do manage to grab will expire and become useless almost immediately. <\/p>\n

Google has already seen a drop in successful attacks during ‘Origin Trials’ (early testing) in collaboration with other web platforms like Okta<\/a>, the blog post reveals.<\/p>\n

\n
\"Google<\/a>
DBSC mechanism explained (Source: Google)<\/figcaption><\/figure>\n<\/p><\/div>\n

Protecting privacy and national security<\/strong><\/h3>\n

Google worked with Microsoft<\/a> to make sure this new tech doesn\u2019t track users, and each website gets a different key. This means companies cannot use this feature to fingerprint devices or to track your online activity across different sites. While Windows users have the update now, Google plans to bring it to macOS soon.<\/p>\n