Browser session hijacking is the reuse of a victim’s already authenticated browser state, such as session cookies, tokens, or other session artifacts, to impersonate that user. Instead of stealing a password and logging in again, an attacker borrows the browser’s proof that the user is already signed in.
This matters because many web apps trust an active session more than a password prompt, and a hijacked session may bypass multi-factor authentication until it expires or is revoked. Attackers often obtain session data from malware on the endpoint, browser-data theft, or man-in-the-browser style activity, then replay it from another device. Defenders reduce the risk by protecting endpoints, hardening browser secret storage, monitoring for unusual session use, and forcing session invalidation after compromise.