A stolen session cookie usually works on any device. Whoever copies it can use it.

With DBSC, each session gets its own key pair. The browser keeps the private key, in hardware such as a TPM where it can, and the server keeps the public key.

The login cookie only lasts a short time. When it expires, Chrome holds the next request, signs a challenge with the private key, collects a new cookie, and then sends the request.

DBSC works alongside passwords, MFA, and WebAuthn sign-ins such as passkeys. It cannot help if malware already controls the device or the browser.