A common attack used by cybercriminals just got harder to pull off. Google has rolled out a security feature in Chrome for Windows that blocks malware from stealing browser cookies. The feature, called App-Bound Encryption, is now available for all Windows users.
Cookie theft is a well-known technique. Attackers use malware to steal session cookies from a browser. These cookies let them impersonate the victim without needing a password. Once stolen, the attacker can access accounts even if two-factor authentication is enabled.
The Threat of Session Hijacking
Session hijacking is not new but remains dangerous. Malware that infects a computer can often read data from any process running on the same system. Browsers store cookies in plaintext or with simple encryption that other programs can access. This makes cookies a prime target. Once stolen, attackers can take over email, banking or social media accounts.
Google's new protection targets this weakness directly. App-Bound Encryption binds the encryption key to a specific application on the system. That means only Chrome itself can decrypt its own cookies. Even if malware has full user-level permissions, it cannot read the cookies stored by Chrome.
How App-Bound Encryption Works
The feature uses a system-level service to encrypt data. When Chrome writes a cookie to disk, it encrypts that data using a key held by a privileged Windows service. Malware running at the user level cannot access that service. To break the encryption, an attacker would need to escalate privileges to the system level, a much harder task.
Google says this approach significantly raises the bar for cookie-stealing malware. Early tests showed that common infostealer malware could no longer extract valid cookies from Chrome. The feature works transparently for users. No settings need to be changed.
This protection currently applies only to Windows. Chrome on macOS and Linux does not have App-Bound Encryption yet. Google plans to extend the feature to other platforms in the future.
Why This Matters
Millions of people rely on browser cookies for seamless access to websites. Cookie theft puts personal data, financial accounts and work logins at risk. By locking cookies to the browser, Chrome removes a major attack vector used by infostealer malware. For Windows users, this update provides a strong layer of defense without any extra effort.
Browser security is a growing concern as cyberattacks become more sophisticated. Google's move signals a shift toward protecting users at the operating system level rather than relying on user behavior alone. This update is part of a larger effort to make Chrome harder to exploit.
Users should keep Chrome updated to ensure they have the latest protections. The App-Bound Encryption feature is enabled by default in Chrome 127 and later on Windows.
