Google has implemented DBSC (Device Bound Session Credentials (DBSC)Chrome. When will Mozilla do the same?

Right now Mozilla has a negative position about it, so we're not gonna implement it. We are generally in favor of providing a way to leverage cryptographic hardware to protect sessions. However, the DBSC design has issues, the most important being:

1. It leaves a window in which an attacker can use a stolen session cookie. Alternative designs which require signatures on every request were not sufficiently explored. Those options could include some form of delegation to shield the TPM from high load if that is necessary.
2. The separate reauthentication flow requires a bespoke protocol which does not match existing cookie handling.

In principle, where there is a TPM available, we don’t mind that being used to back this. However, we don’t want to see a situation where this is expected. Especially if that comes with some device attestation that the website receives. People should be able to choose what software and hardware they use and exposing attestations to the web would undermine that.

A negative position does not necessarily mean that we will not rethink it in the future.

That's a Google (+Microsoft) thing — according to github.com/WebKit/standards-positions/issues/281 this doesn't look like it would be supported by Apple on iOS in the near future, so it won't be available to Firefox iOS.