Unexpected Process Attempting Chrome Remote Debugging Connection

Kaung Khant Ko@kaungkhantko

•updated Jul 24, 2026•5•0•12

Detects an attempt to connect to the Chrome Remote Debugging port (9222) on the local loopback address (127.0.0.1) from an process other than the standard Chrome or Edge browsers. This behavior is often indicative of an adversary attempting to interact with or hijack a running browser session to exfiltrate cookies or session information.