Chrome DevTools Protocol is a legitimate interface used by Chrome-based browsers for debugging, inspection, and automation. It lets a tool talk to a running browser, read page state, trigger actions, capture network traffic, and control tabs or sessions.
CDP matters in cyber security because the same capabilities that help developers and testers can also help attackers. Malware may abuse CDP to inspect browser contents, automate clicks, harvest tokens or form data, and manipulate an already logged-in session without needing to steal a password. This makes CDP useful for browser-focused theft and post-compromise control, especially when defenders expect file-based credential theft instead of live session abuse. In defense, unusual browser-debugging ports, unexpected automation clients, or browsers launched with remote-debug flags can be indicators of abuse and should be investigated.