Passkey adoption grows as Google fights session theft

Passkeys now account for 36% of successful sign-ins across 15 consumer services, according to the FIDO Passkey Index 2026 ^[8].

Passkeys have a 93% success rate, compared to 78% for passwords and traditional multi-factor authentication (MFA) ^[8]. The FIDO Alliance estimates there are 7 billion passkeys in use worldwide ^[8].

Google expands Chrome protections

Google is making Device Bound Session Credentials (DBSC) publicly available to Windows users on Chrome 146 ^[7]. A macOS release is planned for a future version ^[7].

The feature combats session theft from infostealer malware families like LummaC2 ^[7]. These attacks exfiltrate session cookies from browser files and memory to bypass passwords ^[7].

MFA bypass threats

Menlo Security reports that MFA bypass attacks, or single sign-on (SSO) impersonation, circumvent digital tokens and biometrics [5, 6].

These attacks exploit the trust organizations place in SSO providers such as OneLogin, LastPass, and Okta to reach data and systems ^[6].

What we don't know

• When exactly the DBSC feature will be released for macOS users.
• The specific volume of MFA bypass attacks targeting SSO providers in 2026.