Chrome/Edge Launched Headless with CDP Remote Debugging Flags

Emiliano Mema@Nosalva

•updated Aug 28, 2026•2•0•2

Detects the execution of Google Chrome or Microsoft Edge in headless mode with the Chrome DevTools Protocol (CDP) remote debugging port enabled. This configuration allows external control of the browser instance and is often abused by attackers to perform browser-based attacks, intercept traffic, or exfiltrate session data.