CVE-2026-101897: Angular DevTools (Local DoS)
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. From 1.20.0 until 1.21.1, the Angular DevTools background service worker accepts chrome.runtime.sendMessage runtime messages from untrusted web pages or third-party content scripts without adequately verifying the message source. An untrusted sender that obtains a valid randomized victim tabId can direct the extension to use chrome.debugger to attach to another browser tab and trigger Chrome DevTools Protocol breakpoints. This can display the debugging banner, pause JavaScript execution, and prevent interaction with the target tab, but it does not provide remote code execution, privilege escalation, or cross-origin access to memory or credentials. This issue is fixed in version 1.21.1.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Angular DevToolsto a version that resolves this vulnerability.Fixed in 1.21.1
Event History
Frequently Asked Questions
Which installations are affected?
Angular DevTools versions from 1.20.0 through before 1.21.1 are affected. The issue is fixed in version 1.21.1.
What does an attacker need to exploit this issue?
An untrusted web page or third-party content script must be able to send a runtime message to the extension and obtain a valid randomized tabId for the victim tab. The described impact is limited to interfering with a local browser tab.
What is the practical impact on a targeted tab?
An attacker can cause the extension to attach Chrome DevTools Protocol debugging to another tab and trigger breakpoints. This may show the debugging banner, pause JavaScript, and prevent the user from interacting with that tab.
Does this issue allow access to credentials, page memory, or remote code execution?
No. The advisory states that it does not provide remote code execution, privilege escalation, or cross-origin access to memory or credentials.
What can be done if an update cannot be installed immediately?
The provided information identifies upgrading to Angular DevTools 1.21.1 as the fix. No alternative mitigation is specified.