Your Chrome browser on Windows is vulnerable

A billion Chrome users worldwide are potentially at risk from hackers whose malware could take over cookies that store login credentials and other personal data.

• Read also: Take back control of your online privacy

• Read also: How to choose a VPN?

Google is planning to address this, and until then, Chrome users on Windows should be cautious. Others on macOS are not affected by this vulnerability.

As a reminder to witnesses (biscuit) are small tracking files on your computer that record session data for your web accounts. Without these credential shortcuts, you'd spend a lot of time logging in.

Regardless of your operating system, these tiny tracking files on your computer have a nasty habit of following you around the internet and reporting on your activity. Google’s long-awaited removal of these third-party trackers is underway and should have happened a long time ago.

Chrome Cookie Stealing

Google warns that “many web users are falling victim to cookie-stealing malware, allowing hackers to gain access to their web accounts. Malware operators often use social engineering to deliver malware that targets browser cookies.”

Google's warning comes as part of a proposed update to its Chrome browser to address the issue, acknowledging that “despite being essential to the modern web due to their powerful utility, witnesses are also a lucrative target for attackers.”

Google's proposed solution

This is primarily a challenge for desktop computers, and Google's clever response is to tie these cookies to the user's device, rendering them useless if they are stolen in the absence of access to the original device itself. “We are currently prototyping a new web feature called Device Binding Session Credentials (DBSC) which will give users better protection against cookie theft… By binding authentication sessions to the device, DBSC eliminates the value of these cookies leaked from the computer. »

Now that you've been warned,

Put Google's new beta update aside for now – consider this a warning to be aware of the risks and keep them in mind – especially when logging into financial sites or trading systems owned by the company you work for.

Google explains: “This type of cookie theft happens after you log in, so it bypasses two-factor authentication and any other verification checks at the time of login.”

In a 2023 report, SpyCloud said it “recovered 1.87 billion malicious witness records… allowing cybercriminals to infiltrate organizations by posing as legitimate users and accessing an active web session, effectively bypassing security best practices such as multi-factor authentication (State Department).”

Until your browser cookies are completely replaced, check for updates, and use another browser, because cookie theft by hackers still has a bright future ahead.