Key takeaways
Session token theft over firewall attacks: Adversaries are bypassing network firewalls by stealing active session cookies directly from enterprise browsers via adversary-in-the-middle (AiTM) attacks.
Immediate endpoint remediation: Manual backend access revocation introduces costly delays; active session hijacking requires immediate, programmatic remediation at the source.
Automated session revocation: By configuring Okta’s Identity Threat Protection for Google Chrome Enterprise, security teams can automatically purge compromised browser cookies and terminate hijacked sessions in near real time.
Take a look at your screen right now. If you work at an enterprise, your email, your CRM, and your internal wiki are probably all just tabs. Almost everything you need to do your job lives inside a browser.
Malicious actors know this, too. According to a recent Omdia report, almost half (49%) of organizations suffered a successful browser-based attack in the last 12 months.
These adversaries aren't always trying to brute-force a firewall anymore. Instead, they’re increasingly relying on tactics such as adversary-in-the-middle (AiTM) attacks to steal an active session token directly from a user's browser cache. Once they have that cookie, they can walk through the front door.
The traditional way of handling this is surprisingly manual. Security teams get an alert, file a ticket, and try to revoke access on the backend. But when an attacker actively hijacks a session, you can't wait for a human to read a dashboard. You need to sever the connection immediately, right at the source.
What is Okta's Identity Threat Protection feature for Google Chrome Enterprise?
Through a collaboration with Google, Okta can now instruct managed Chrome browsers to purge session cookies and clear cached browser data when Identity Threat Protection (ITP) flags risks for the users in the cloud.
The moment ITP detects a threat, you can programmatically clear the local browser cookies and drop the session entirely.
Configuring real-time risk detections in Identity Threat Protection
To automate this, you first need to know exactly when a user is under attack. Okta’s Identity Threat Protection evaluates user behavior long after the initial login. It continuously assesses user risk and automatically responds to identity threats across your ecosystem. For example, you can configure entity risk policies to act as tripwires, clearing browser sessions and cookies based on:
- Suspicious app access: Catch active app session cookie theft and hijacking attempts in near real time.
- User-reported fraud: Clear browser session and cookies the moment an employee clicks "This wasn't me" on a suspicious activity alert.
Check out the full list of ITP-supported risk detections in our product documentation center.
How does automated session revocation work at runtime?
Okta links user sessions to managed Chrome profiles in the background using the Chrome Device Trust Connector.
Let's look at how this plays out from setup to a real security event at runtime:
- Policy configuration: Define the specific risk levels or events (such as suspicious app access) in an ITP entity risk policy.
- Real-time risk signal: ITP evaluates active sessions in real time. If it identifies a configured detection, your entity risk policy immediately triggers an automated Okta Workflow.
- API invocation: The Okta Workflow invokes the Chrome Clear Browsing Data API.
- Endpoint remediation: The browser’s cookies and session data are immediately cleared without manual admin intervention.
Key benefits: No-code setup and full audit visibility
Building this remediation chain is straightforward. You don't need to write custom API calls; it's a drag-and-drop action card in Okta Workflows.
Okta’s System Log records every automated wipe, providing a clear audit trail of the triggering policy and targeted profile.
We can no longer afford to treat the browser as just another application. It is another critical attack surface. If you want to protect it, you need the ability to shut down compromised sessions instantly.
Turn your Google Chrome enterprise browser into an active security enforcement point rather than a vulnerability. Shut down active identity threats and keep compromises contained. Follow the steps in our ITP configuration guide to start protecting your managed Chrome environment.
