Chrome device-bound cookies block stolen session attacks

Chrome's new device-bound session credentials make stolen session cookies virtually useless by requiring proof of device possession. Attackers who load a stolen cookie into another browser can no longer access accounts without the victim's password or two-factor authentication.