/usr/bin/chromium-headless-shell runs the real binary as a child of sh:

    #!/bin/sh -e

    /usr/lib/chromium/chromium-headless-shell "$@"

A program that launches the wrapper and later sends SIGTERM to the PID it
started only kills sh. The browser and its child processes are reparented
to init and keep running. headless-shell is normally driven by automation
that manages it by PID, so this leaks a process tree per launch.

To reproduce:

    /usr/bin/chromium-headless-shell --headless --no-sandbox \
        --remote-debugging-port=0 &
    sleep 2; kill $!; sleep 2
    pgrep -af /usr/lib/chromium/chromium-headless-shell

The browser processes are still listed. With the patch below, none are.

The main chromium wrapper already uses exec for this case.
debian/scripts/chromium-shell has the same pattern and the same fix applies.
The script is the same in bookworm, trixie and sid.
--- a/debian/scripts/chromium-headless-shell
+++ b/debian/scripts/chromium-headless-shell
@@ -1,3 +1,3 @@
 #!/bin/sh -e

-/usr/lib/chromium/chromium-headless-shell "$@"
+exec /usr/lib/chromium/chromium-headless-shell "$@"