From: uazo <uazo@users.noreply.github.com>
Date: Mon, 19 Jan 2026 12:00:34 +0000
Subject: Disable device bound session

Disable DBSC due to potential privacy issues
see https://w3c.github.io/webappsec-dbsc/#privacy-considerations

License: GPL-2.0-or-later - https://spdx.org/licenses/GPL-2.0-or-later.html
---
 .../metrics/chrome_browser_main_extra_parts_metrics.cc |  6 ++++++
 net/BUILD.gn                                           |  7 +++++++
 net/base/features.cc                                   | 10 ++++++----
 net/features.gni                                       |  2 +-
 4 files changed, 20 insertions(+), 5 deletions(-)

diff --git a/chrome/browser/metrics/chrome_browser_main_extra_parts_metrics.cc b/chrome/browser/metrics/chrome_browser_main_extra_parts_metrics.cc
--- a/chrome/browser/metrics/chrome_browser_main_extra_parts_metrics.cc
+++ b/chrome/browser/metrics/chrome_browser_main_extra_parts_metrics.cc
@@ -127,6 +127,10 @@
 #include "chrome/browser/signin/bound_session_credentials/unexportable_key_service_factory.h"
 #endif  // BUILDFLAG(IS_MAC)
 
+#if BUILDFLAG(IS_WIN) || BUILDFLAG(IS_MAC)
+#include "net/net_buildflags.h"
+#endif
+
 namespace {
 
 // The number of restarts to wait until removing the enable-benchmarking flag.
@@ -937,7 +941,9 @@ void RecordStartupMetrics() {
 #endif  // BUILDFLAG(IS_WIN)
 
 #if BUILDFLAG(IS_WIN) || BUILDFLAG(IS_MAC)
+#if BUILDFLAG(ENABLE_DEVICE_BOUND_SESSIONS)
   crypto::MaybeMeasureTpmOperations(unexportable_keys::GetDefaultConfig());
+#endif
 #endif  // BUILDFLAG(IS_WIN) || BUILDFLAG(IS_MAC)
 
   // Record whether Chrome is the default browser or not.
diff --git a/net/BUILD.gn b/net/BUILD.gn
--- a/net/BUILD.gn
+++ b/net/BUILD.gn
@@ -1291,6 +1291,13 @@ component("net") {
     ]
   }
 
+  if (!enable_device_bound_sessions) {
+    sources += [
+      "device_bound_sessions/session_error.cc",
+      "device_bound_sessions/session_error.h",
+    ]
+  }
+
   if (enable_device_bound_sessions) {
     sources += [
       "device_bound_sessions/cookie_craving.cc",
diff --git a/net/base/features.cc b/net/base/features.cc
--- a/net/base/features.cc
+++ b/net/base/features.cc
@@ -362,12 +362,14 @@ BASE_FEATURE(kUseNetworkPathMonitorForNetworkChangeNotifier,
 );
 #endif  // BUILDFLAG(IS_APPLE)
 
-#if BUILDFLAG(IS_WIN)
-BASE_FEATURE(kDeviceBoundSessions, base::FEATURE_ENABLED_BY_DEFAULT);
-#else
 BASE_FEATURE(kDeviceBoundSessions, base::FEATURE_DISABLED_BY_DEFAULT);
+BASE_FEATURE(kPersistDeviceBoundSessions,
+#if BUILDFLAG(IS_WIN) && BUILDFLAG(ENABLE_DEVICE_BOUND_SESSIONS)
+    base::FEATURE_ENABLED_BY_DEFAULT
+#else
+    base::FEATURE_DISABLED_BY_DEFAULT
+);
 #endif
-BASE_FEATURE(kPersistDeviceBoundSessions, base::FEATURE_ENABLED_BY_DEFAULT);
 BASE_FEATURE_PARAM(bool,
                    kDeviceBoundSessionsRefreshQuota,
                    &kDeviceBoundSessions,
diff --git a/net/features.gni b/net/features.gni
--- a/net/features.gni
+++ b/net/features.gni
@@ -57,7 +57,7 @@ declare_args() {
   chrome_root_store_only = is_win || is_mac || is_linux || is_chromeos
 
   # DBSC is only supported on Windows, Linux and Mac for now.
-  enable_device_bound_sessions = is_win || is_linux || is_mac
+  enable_device_bound_sessions = false
 
   # Bracketed URIs parsing is only available for debug builds.
   # TODO(crbug.com/365771838): Ensure tests are updated if needed if this
--