Headless Chrome or Edge Launched with CDP Remote Debugging by Non-Browser Parent

Duo Tech@duotech

•updated Jul 24, 2026•1•0•3

A non-browser parent process (installer, service, msiexec.exe/rundll32.exe/services.exe, or lib.dll-style loader) spawning Chrome or Edge headlessly with CDP remote-debugging flags enabled. Requires an anomalous parent to reduce false positives from legitimate browser automation frameworks that also use --headless and --remote-debugging-port.