Vercel Device Bound Session Credentials: How DBSC Makes Stolen Session Cookies Useless, What Is Confirmed and What to Check

Vercel has started turning on a Chrome security feature called Device Bound Session Credentials (DBSC) for logins to vercel.com. That is according to a public post by Vercel's chief technology officer on November 3, 2026. If it works as described, a session cookie that malware steals from a developer's computer stops working on the attacker's machine. That matters because a stolen Vercel session can give someone control of your live website, its deployments and its settings.

What happened

On Tuesday, November 3, 2026, Malte Ubl, Vercel's CTO, posted on X that Vercel is taking "a slow approach to the rollout" of DBSC for vercel.com sessions. He described it as protection for people who "install info-stealer malware", including through a supply chain attack. He wrote that once the key is created, "The private key can never be retrieved ever again," and added: "Not by us, not by you, not by the malware."

He said the rollout is gradual because of special cases, such as "oauth apps that we needed to resolve." He said it works only in Chrome on Mac and Windows for now. Vercel is also "working on a kind of polyfill for other browsers", which he called less secure. And a related technique called DPoP is being shipped for the Vercel CLI.

X blocks many automated readers, so we read the post's text through a public mirror and checked it against BleepingComputer's report of November 4, 2026. Vercel's public changelog entries for November 2 to 4, 2026 do not mention DBSC or DPoP. For now, the CTO's post is the only Vercel source.

What is Device Bound Session Credentials (DBSC)?

When you log in to a website, the site gives your browser a session cookie so you don't have to sign in on every page. Infostealer malware copies those cookies. The attacker loads them into their own browser and is logged in as you, with no password and no MFA prompt.

DBSC is a web standard Google developed through the W3C. Google says Microsoft worked with it on the design. At login, the browser creates a key pair. Google says the private key is generated in the TPM chip on Windows or the Secure Enclave on macOS, and that it "cannot be exported from the machine." The site then hands out short-lived cookies. Before Chrome gets a fresh cookie, it has to prove it holds the private key. A copied cookie expires quickly, and the attacker cannot refresh it without that key.

On April 9, 2026, Google said DBSC was "now entering public availability for Windows users on Chrome 146", with macOS support coming in a later Chrome release. Google also said it had "observed a significant reduction in session theft since its launch". It did not publish any figures.

What is claimed and what is confirmed

Does DBSC protect my own website on Vercel?

Not automatically, as far as anyone has said. The CTO's post covers logging in to vercel.com, meaning the dashboard your team uses to manage projects. Nothing we read says DBSC is switched on for the login pages of sites and apps that run on Vercel.

If you want DBSC for your own customers' or staff logins, your developers have to build it in. Chrome's developer guide says a site needs a registration endpoint and a refresh endpoint, plus short-lived cookies. Browsers without DBSC support carry on with normal cookies, so adding it does not lock anyone out.

What DBSC does not stop

• Malware that is already there at login. Chrome's documentation says malware present during session registration may be able to extract the private key.
• Malware acting on the infected machine itself. DBSC stops a stolen cookie from being reused somewhere else. It does not remove the malware, which can still use the browser on the infected device.
• Other browsers and older hardware. Where DBSC is not supported, or the device has no secure key storage, Chrome falls back to ordinary cookies.
• Plain HTTP pages. DBSC only applies to HTTPS.

Why it matters for a company website

Whoever holds a Vercel session can usually deploy code, change domains and read project settings. Our post on the WorkOS and Trigger.dev breach shows how much damage exposed environment variables on a developer platform can do. Session theft gets around MFA completely, which is why we keep warning about it in AI phishing and fake login pages and Google Calendar phishing. DBSC narrows one of the easiest routes in, but only on supported browsers and only where the site has built it in.

What to do this week

If you want help locking down developer accounts and hosting, see our security hardening work.

Device bound session credentials questions people are asking

What is Device Bound Session Credentials?

It is a browser standard that ties a login session to a key stored in your computer's security chip. A cookie copied to another machine stops working once it expires.

Is DBSC turned on for my Vercel account?

Possibly. Vercel's CTO says the rollout is gradual, and Vercel has not published a way to check.

Does DBSC work in Safari, Firefox or Edge?

Vercel's CTO says it works only in Chrome on Mac and Windows for now. Vercel is building a less secure fallback for other browsers.

Does DBSC replace MFA?

No. MFA protects the moment you log in. DBSC protects the session after that. You want both. Our guide on passkey security and account recovery covers the login side.

Can infostealers still steal sessions with DBSC?

They can still copy cookies, but the copies stop working quickly on another machine. Malware that is already present when you log in may still get the key.

Does this protect the logins on my site hosted on Vercel?

Not unless your developers add DBSC to your own login system. The announcement covers vercel.com only.

The bigger lesson

Logging in safely is only half the job. The session that follows is now what attackers go after, and it is only as safe as the device it lives on. Keep browsers updated, keep admin access to a short list of people, and treat any infected laptop as an open door to every account on it.

To tighten your developer accounts and hosting, see security hardening or request a quote.

Get security alerts like this by email, along with our free checklist, at /security-alerts.

Sources: Malte Ubl on X; Google: Protecting cookies with Device Bound Session Credentials; Chrome for Developers: Device Bound Session Credentials.