A headless browser is a web browser that runs without a visible window or user interface. It still loads pages, executes scripts, handles sessions, and can interact with web applications, which makes it useful for testing, scraping, and other automation tasks.
In cyber security, headless browsers matter because attackers can abuse them to make malicious traffic look like normal browser activity. A piece of malware may launch Chrome or Edge in headless mode, use localhost communication, and relay command-and-control traffic through the browser stack instead of opening an obvious outbound connection itself. Defenders watch for unusual browser launches, strange parent-child process chains, and automation behavior on systems where no legitimate script or test job is expected.