CDP, the Chrome DevTools Protocol
CDP (Chrome DevTools Protocol) is the set of commands a program uses to drive a browser: open an address, click a button, type text, run a script on the page, take a screenshot. The browser's own developer tools speak the same language, and so do Playwright and Puppeteer.
The commands read plainly: Page.navigate, Runtime.evaluate, Page.captureScreenshot.
Three ways a program connects
| Route | What it looks like | The catch |
|---|---|---|
| Port | the browser starts with --remote-debugging-port and the program connects to it | the port is open, and its owner is not the only one who can reach it |
| Pipe | a channel between the program and the browser, with no network port | nothing outside can connect — that is exactly what makes it better |
| Through an extension | an extension inside the browser issues the commands | no debugging switches on the command line at all |
The difference is not cosmetic. An open debugging port is full access to the browser: through it, every cookie in the profile can be read, including the ones page scripts cannot reach. That is precisely why Chrome 136 banned debugging on the default profile folder.
A measurement worth knowing in advance
Signing in to a Google account fails whenever the browser has a debugging channel — any of them. We tested this separately: the port, the pipe, and even the case where the channel is merely open and no commands are sent. The result is the same every time — the sign-in does not go through.
Fingerprint spoofing does not fix it: what is being detected is not how the browser looks, but the plain fact that it can be driven from outside.
The practical consequence: automation and signing in to Google are a choice, not a combination. A profile driven over a debugging channel is unfit for a Google sign-in; a profile that has to be signed in to Google gets automated the other way — from an extension inside.
Why an ordinary person should care
Directly — they should not. Indirectly, because scripts, automation and driving the browser from an AI agent all rest on CDP. And also because an open debugging port on your machine is a genuine hole: if a program suggests you "just turn on debugging" in your main browser, that is worth asking about.