Chrome 147 for Windows and 150 for macOS ships Device Bound Session Credentials to limited users

Google enabled DBSC in Chrome 147 for Windows and 150 for macOS. The feature signs session assertions with keys that never leave the hardware root of trust. Sites store the corresponding public key and reject any challenge response lacking a valid hardware signature. Developer tools expose active DBSC sessions under the Application tab when the protection is live.

Passkey deployments and FIDO2 specifications already demonstrated the same public-key model. DBSC extends that model from initial authentication to ongoing session maintenance. Scott Helme documented identical protection logic in his Report URI analysis. Session cookie theft remains possible, yet the stolen cookie fails the signed challenge because the private key stays sealed.

The limited rollout allows Google to measure assertion failure rates and hardware compatibility before broader distribution. Other Chromium forks have not yet merged the changes. macOS support relies on the Secure Enclave while Windows uses TPM 2.0 or equivalent. Both paths match existing platform attestation primitives already used by enterprise endpoint management.

Wider enablement will require site operators to implement the DBSC challenge endpoint. Google has not published a timeline for default activation or extension to Linux and Android.