This is now entering public availability: https://security.googleblog.com/2026/04/protecting-cookies-with-device-bound.html . We'll look into working on this in the next few months.

One big question: do we just implement this to work with native Chrome support? Since no other browsers seem to support this right now, or possibly any time soon? Or do we also want to explore a far more complex DPoP-like fallback as well?

Comments from another task:

In T210909#11146009, @Bawolff wrote:

In practice session theft is an almost non-existent threat. The only way to pull it off is malicious insider at WMF, or if the client's computer is compromised (not just an XSS, but actual full device compromise). Its very hard to come up with scenarios where device bound sessions actually stop an attacker.

In T210909#11146360, @Bugreporter wrote:

Please note browser extensions can get HttpOnly cookies, so it is possible that a session be stolen if a malicious phishing extension is installed.

I don't think device compromise is such a low threat these days, still this is a good clarification about the extent to which device-bound cookies will increase security.