Stealing a session cookie can let hackers bypass passwords and multifactor authentication. Vercel wants to make that shortcut much harder to exploit.
Session cookies are credentials that let a website recognize a user is still authenticated, so the user doesn’t have to log in every time they revisit the site or take an action.
While convenient, it creates a security weakness: attackers can steal valid session cookies through infostealer malware and replay them from another device to impersonate their victims.
To help end that, Vercel is rolling out Device Bound Session Credentials (DBSC), a technology that ties authenticated browser sessions to cryptographic keys stored securely on the original device.
This means that even if attackers steal a session cookie, they ordinarily can’t reuse it on another device without also possessing the corresponding private key.
Vercel joins the fight against session-cookie theft
The development was announced on Tuesday, Nov. 3, in an X post by Vercel’s CTO, Malte Ubl. The technology binds an authenticated browser session to a cryptographic key pair, requiring the browser to prove possession of its private key before the server renews the session.
For instance, an infostealer infects a developer’s computer and extracts their Vercel session cookie. The attacker could then try importing that cookie into another browser to access the developer’s account without entering their password or passing MFA again.
With DBSC enabled, however, the attacker’s browser would now also need to prove possession of the private key associated with the original session. Since stealing the cookie does not automatically give the attacker that key, the server can reject the attempt to renew the session.
Vercel’s implementation follows Google’s introduction of DBSC support in Chrome 146 for Windows and Chrome 148 for macOS, and only works on Chrome for now. Ubl also noted that the feature is rolling out gradually to Vercel users.
The result is an additional layer of protection against cookie replay: even when attackers get their hands on a valid session cookie, transferring it to another device is no longer enough to maintain access to the victim’s account.
Vercel’s new feature has a catch
However, a hardware requirement could limit who benefits from Vercel’s new protection: a compatible Trusted Platform Module (TPM).
DBSC relies on this security component to generate and protect the private cryptographic keys that bind browser sessions to individual devices.
On Windows, Chrome uses TPM hardware to store these keys securely. This means users whose computers lack a compatible TPM, or whose TPM is unavailable to Chrome, may not benefit from DBSC. On macOS, Chrome uses Apple’s Secure Enclave to provide the equivalent hardware-backed key protection.
The requirement reflects a broader shift in computer security over recent years, with hardware-backed security becoming an increasingly important foundation for protecting devices, identities and sensitive data.
Microsoft, for instance, requires TPM 2.0 for Windows 11 installation, partly because several of its security capabilities rely on the technology for secure key storage, encryption and device integrity checks. Features such as BitLocker and Windows Hello also use TPM capabilities to strengthen data and identity protection.
Consequently, Vercel’s protection is another example of how modern security measures increasingly depend on hardware capabilities, not just software updates. Users with older or unsupported hardware may therefore miss out on newer protections designed to keep their accounts safe.
What Vercel’s new feature means for enterprises and developers
For developers and organizations using Vercel, the new protection makes stolen session cookies a less reliable way for attackers to take over accounts. Even if infostealer malware extracts a valid Vercel session cookie, DBSC adds another verification requirement that makes replaying it from a different device substantially harder.
However, the protection does not eliminate the broader threat posed by infostealer malware. Attackers may still steal passwords, API tokens and other sensitive credentials, while malware operating on an already compromised device remains a separate concern.
Organizations should continue enforcing multifactor authentication, monitoring suspicious account activity, keeping browsers and devices updated, and restricting access to sensitive development environments.
IT teams should also verify whether their managed devices support DBSC and whether the feature is active for their users as Vercel’s rollout progresses.
Ultimately, DBSC addresses an important weakness in browser authentication, but its effectiveness will depend on browser compatibility, device support and how consistently services enforce device-bound session renewal.
In other news, hackers targeted outdated iPhones and Android devices through compromised websites, exploiting previously patched vulnerabilities to steal passwords, browser cookies, and sensitive data without requiring users to download files or click additional links.