Chrome is enhancing security against cookie theft malware on Windows with App-Bound Encryption in Chrome 127. This encryption method ties data to the specific app's identity, preventing malicious applications from accessing sensitive information. Previously, Windows' Data Protection API (DPAPI) provided limited protection against malware that could execute code as the logged-in user. The new encryption relies on a privileged service to verify app identity during encryption and decryption. This makes it more difficult for malware to bypass the protection without gaining system privileges or injecting code into Chrome, increasing the risk of detection. Enterprise environments without administrative privileges for users benefit significantly from this protection, as malware cannot easily escalate privileges. However, App-Bound Encryption may not function in environments with roaming Chrome profiles. Enterprises are encouraged to follow best practices for roaming profiles and can configure the encryption using the ApplicationBoundEncryptionEnabled policy. Chrome emits an event for failed verification, providing defenders with additional detection capabilities. App-Bound Encryption adds to Chrome's existing initiatives to combat cookie theft malware, including Safe Browsing, Device Bound Session Credentials, and account-based threat detection.