The feature, called device-bound session credentials, links an authenticated web session to the device where the user signed in. Attackers who obtain a browser session cookie can sometimes load it into another browser and gain access to an account without entering the victim's password or completing two-factor authentication. The private key is kept inside that hardware rather than exposed to the operating system or browser. When Chrome needs to maintain or refresh a session, the site can require the browser to sign a challenge with the private key. But they do not necessarily protect an already authenticated browser session.