# Vercel starts binding dashboard sessions to devices with DBSC in Chrome

Source: https://startwithidentity.com/blog/2026-11-04-vercel-starts-binding-dashboard-sessions-to-devices-with-dbsc-in-chrome/
Last updated: 2026-11-04
License: content by Start with Identity. Cite the source URL.

---

Vercel has begun a gradual rollout of Device Bound Session Credentials (DBSC) for sign-ins to vercel.com, CTO Malte Ubl said this week, as reported by [Help Net Security](https://www.helpnetsecurity.com/2026/11/05/vercel-security-review-session-hijacking/). Under DBSC, the browser creates a key pair at login and, per [Chrome's documentation](https://developer.chrome.com/docs/web-platform/device-bound-session-credentials), keeps the private key in secure hardware such as a TPM where available. The server then issues short-lived cookies that the browser must keep refreshing by signing a challenge with that key, so a cookie copied to another machine soon stops working. Ubl said DBSC is "currently only supported by Chrome on Mac and Windows," that the rollout is slow because of "lots of special cases for things like [OAuth] apps," and that Vercel is building a polyfill for other browsers that is "less secure." Vercel is also working on DPoP for its command-line tool.

## Why it matters

Vercel has a direct reason to care. Its [April 2026 incident](https://vercel.com/kb/bulletin/vercel-april-2026-security-incident) started when an attacker used a compromised third-party AI tool to take over an employee's Google Workspace account and then their Vercel account. Stolen session cookies, usually lifted by [infostealers](https://startwithidentity.com/techniques/infostealer-credential-harvesting/), are the common way past MFA, and [device-bound session credentials](https://startwithidentity.com/glossary/device-bound-session-credentials/) are the browser control aimed at that [session cookie theft](https://startwithidentity.com/techniques/session-cookie-theft/).

Two limits apply. The [W3C draft](https://w3c.github.io/webappsec-dbsc/) says DBSC does not stop an attacker who is resident on the user's device from using the live session, and it covers browser sessions only. Tokens used by the CLI and API stay bearer tokens until [DPoP](https://startwithidentity.com/glossary/dpop/) ships, so keep those scoped, short-lived and out of shared environment files. Developers who run their own apps on Vercel can add DBSC to their own login flow; Chrome falls back to normal cookies where secure key storage is missing.

Source: [Help Net Security](https://www.helpnetsecurity.com/2026/11/05/vercel-security-review-session-hijacking/), [Chrome for Developers](https://developer.chrome.com/docs/web-platform/device-bound-session-credentials)