Estimated Rollout for Android and iOS

[invisibleroads]

Thank you for your work on this much needed security enhancement.

The documentation suggests that DBSC is in production for Chrome on Windows.

Are you able to provide an estimated timeline for DBSC support in Chrome on Android and iOS?

---

As a side note for other developers, we were able to get DBSC working for Chrome on Linux by enabling the following chrome://flags

• Device Bound Session Credentials with software keys
• Device Bound Session Credentials (Standard)

[olibos]

Hello @invisibleroads ,

I'm trying on linux with :

But chrome never call my DBSC endpoint /auth/dbsc/start.
Here is my test case

POST /auth/login

Headers

Name	Value
content-type	application/json
content-length	38
origin	https://localhost:7253
referer	https://localhost:7253/
sec-fetch-site	same-origin
sec-fetch-mode	cors
cache-control	no-cache
user-agent	Chrome/147.0.0.0 (Linux x86_64)

Body

{
  "Username": "bob",
  "Password": "secret"
}

---

Response

Headers

Name	Value
content-type	application/json; charset=utf-8
access-control-allow-origin	https://localhost:7253
access-control-allow-credentials	true
vary	Origin
sec-session-registration	(ES256 RS256); path="/auth/dbsc/start"; challenge="zBQ1xfAPdKEn3gtEyYEFlctbP6RuJWwx"
set-cookie	auth_session=e21d631e283c477b8af32825ba0a6036; max-age=86400; path=/; secure; samesite=lax; httponly
date	Mon, 04 May 2026 11:45:28 GMT

[invisibleroads]

@olibos

I had to update Chrome and enable the flags mentioned above.

Note that you won't see the request being sent in the Chrome Developer Console. I only see the request in the application server log.

[drubery]

That's correct. Chrome officially supports Windows and will soon support Mac. Software keys make testing on Linux possible, but the use of software keys voids any security benefit of DBSC.

We have no timeline on Android or iOS. If you're seeing significant credential theft on either platform, please let us know so we can evaluate the priority of shipping on mobile.

[kashyaprpuranik]

Do you know when the support for Mac might roll out?