⬇ Download holy card: ·
Blessed Headroll, the Headless One
Patron of headless browsers, debug ports left open, and services that render other people's pages.
Life
On 5 April 2023 Canva's engineers described Headroll, found while running Chromium without a user interface to render images and documents. A hostile web page could talk to the browser's own developer tools, bypassing the same-origin policy and the proxy settings. Google tracked it as CVE-2023-0704 and fixed it in Chrome 110: a browser still headless, but no longer witless.
Prayer
O Blessed Headroll, who roams headless among the world's pages, let our DevTools answer only those who called them. Amen.
How to celebrate
Celebrated by updating Chromium and closing the remote debugging ports nobody remembers opening.
Lose your head, and the door swings open.