Session-bound data is information that exists only while a user is logged in and the application session is active. It may be stored in browser memory, rendered in a web page, or kept in a temporary session store, rather than being written as long-lived data on the device. Examples include authenticated page content, account metadata, and other state tied to the current browser context.
In cyber security, session-bound data matters because it is often the real target after an attacker gains a foothold in the browser. A cross-origin leak, malicious extension, XSS flaw, or compromised script can expose what a logged-in user can see, even if the underlying service still uses strong encryption. Defenders reduce risk by limiting what is shown in session, isolating origins, hardening browser extensions, enforcing short session lifetimes, and requiring reauthentication for sensitive actions.