PT-2026-113788 · Google · Angular Devtools
CVE-2026-101897
·
Published
2026-10-14
·
Updated
2026-10-14
CVSS v4.0
5.1
Medium
| Vector | AV:N/AC:H/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:N/SI:L/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
Name of the Vulnerable Software and Affected Versions
Angular DevTools versions 1.20.0 through 1.21.0
Description
The background service worker in Angular DevTools fails to adequately verify the source of
chrome.runtime.sendMessage runtime messages. An untrusted sender with a valid randomized tabId can instruct the extension to use chrome.debugger to attach to another browser tab and trigger Chrome DevTools Protocol breakpoints. This action can result in the display of a debugging banner, the pausing of JavaScript execution, and the prevention of user interaction with the target tab.Recommendations
Update to version 1.21.1.
Exploit
Fix
Origin Validation Error
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Angular Devtools