ANGULAR DEVTOOLS · CVE-2026-101897 · Other
FIX → 1.21.1
A malicious web page or content script can message the Angular DevTools browser extension and make it attach Chrome's debugger to other tabs. The victim sees a debugging banner, and those tabs freeze or stop responding to input, but no code runs and no data is stolen.
first public Sep 16, 2026 · 2 sources
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Only people who have the Angular DevTools browser extension installed at a version from 1.20.0 up to but not including 1.21.1. Exposure requires visiting an untrusted page while other tabs are open; the attacker must guess a randomized tab ID, which the advisory calls impractical.
Not affected if extension-not-installed, version-1.21.1-or-later
Who cares angular-devtools, browser-extension, chrome, firefox
chrome://extensions or about:addons and look for Angular DevTools.1.21.1.Upgrade to 1.21.1
1.21.1 or later.A Denial of Service vulnerability exists in the Angular DevTools browser extension. Untrusted web pages or third-party content scripts can dispatch Chrome runtime messages to Angular DevTools' background service worker, directing it to attach chrome.debugger to arbitrary browser tabs and trigger Chrome DevTools Protocol (CDP) breakpoints, resulting in a local Denial of Service (tab execution pause/freeze).
Impact: Local Denial of Service (DoS) of target browser tabs. An attacker can force the browser to display the Chrome debugging banner ("Angular DevTools" started debugging this browser), freeze JavaScript execution, and prevent user interaction on other open tabs. There is no remote code execution, privilege escalation, or unauthorized access to cross-origin memory or credentials.
Attack Preconditions:
chrome.runtime.sendMessage targeting Angular DevTools with a target tabId.
tabId. Tab IDs are randomized per session and hidden from untrusted web pages, making blind guessing impractical (requiring High Attack Complexity).Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
Update Angular DevTools to version 1.21.1 or later.
Chrome and Firefox update extensions automatically.
chrome://extensions and clicking Update.about:addons and clicking Check for Updates under the gear icon.Note: It may take some time for version 1.21.1 to be reviewed and approved by each browser extension store vendor before it is available.
This page as .md · .json · CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:N/SI:L/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.