Google has shipped Device Bound Session Credentials (DBSC) in Chrome 146 for Windows, cryptographically tying session cookies to the device’s Trusted Platform Module so stolen credentials cannot be replayed on attacker-controlled machines. This directly counters one of the most exploited techniques in the current threat landscape: infostealer-driven session hijacking, used extensively by malware families such as LummaC2 to bypass multi-factor authentication entirely. DBSC’s W3C standardization path and Chrome’s dominant browser market share signal a structural shift toward hardware-anchored identity, raising the baseline cost of credential theft attacks across the enterprise.