{"id":"CVE-2026-101897","kind":"vulnerability","aliases":["CVE-2026-101897","GHSA-r653-wxfp-pp9c"],"related":[],"title":"Angular DevTools (Local DoS)","description":"A Denial of Service vulnerability exists in the Angular DevTools browser extension. Untrusted web pages or third-party content scripts can dispatch Chrome runtime messages to Angular DevTools' background service worker, directing it to attach `chrome.debugger` to arbitrary browser tabs and trigger Chrome DevTools Protocol (CDP) breakpoints, resulting in a local Denial of Service (tab execution pause/freeze).\r\n\r\n### Impact & Attack Preconditions\r\n\r\n**Impact:**\r\nLocal Denial of Service (DoS) of target browser tabs. An attacker can force the browser to display the Chrome debugging banner (*\"Angular DevTools\" started debugging this browser*), freeze JavaScript execution, and prevent user interaction on other open tabs. There is no remote code execution, privilege escalation, or unauthorized access to cross-origin memory or credentials.\r\n\r\n**Attack Preconditions:**\r\n1. The victim has the Angular DevTools browser extension (version >= 1.20.0, < 1.21.1) installed and active.\r\n2. The victim navigates to an untrusted/malicious web page while other browser tabs are open.\r\n3. The malicious page dispatches a `chrome.runtime.sendMessage` targeting Angular DevTools with a target `tabId`.\r\n   * **Note:** The malicious page must obtain a valid victim `tabId`. Tab IDs are randomized per session and hidden from untrusted web pages, making blind guessing impractical (requiring High Attack Complexity).\r\n\r\n### Patches\r\nUpdate Angular DevTools to version **1.21.1** or later.\r\n\r\n### Rollout\r\nChrome and Firefox update extensions automatically.\r\n- **Chrome users:** Can manually ensure they are running the latest version by visiting `chrome://extensions` and clicking **Update**.\r\n- **Firefox users:** Can manually update by visiting `about:addons` and clicking **Check for Updates** under the gear icon.\r\n\r\n*Note: It may take some time for version 1.21.1 to be reviewed and approved by each browser extension store vendor before it is available.*\r\n\r\n### References\r\n* Patch PR: [angular/angular#70623](https://github.com/angular/angular/pull/70623)\r\n\r\n### Credits\r\n- Thai Son Dinh (sondt) from VinSOC Labs (R&D)","summary":"A malicious web page or content script can message the Angular DevTools browser extension and make it attach Chrome's debugger to other tabs. The victim sees a debugging banner, and those tabs freeze or stop responding to input, but no code runs and no data is stolen.","severity":"medium","cvss":5.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Angular DevTools","fixed":["1.21.1"],"affected":">= 1.20.0, < 1.21.1","ecosystem":"other"}],"ecosystems":["other"],"tags":["angular-devtools","browser-extension","chrome","cwe-346","cwe-441","cwe-940","firefox","other"],"not_affected_if":["extension-not-installed","version-1.21.1-or-later"],"how_to_check":"- Open `chrome://extensions` or `about:addons` and look for Angular DevTools.\n- Check that its version is below `1.21.1`.","fix":"- Angular DevTools: update to `1.21.1` or later.","status":"open","published_at":"2026-09-16T13:23:27+00:00","first_seen_at":"2026-11-09T22:53:17+00:00","triaged_at":"2026-11-09T23:01:11+00:00","updated_at":"2026-11-09T23:01:11+00:00","category":"other","confidence":0.8,"triage":{"at":"2026-11-09T23:01:11Z","model":"claude-haiku-5-5","output":{"fix":"- Angular DevTools: update to `1.21.1` or later.","reach":"internet","title":"Angular DevTools: malicious web pages can freeze other open browser tabs","impact":"low","summary":"A malicious web page or content script can message the Angular DevTools browser extension and make it attach Chrome's debugger to other tabs. The victim sees a debugging banner, and those tabs freeze or stop responding to input, but no code runs and no data is stolen.","audience":"everyone","category":"other","nicknames":[],"who_cares":["angular-devtools","chrome","firefox","browser-extension"],"confidence":0.8,"fix_status":"available","needs_auth":"no","worst_case":"Browser tabs freeze and show a debugging banner; no code execution or data theft.","analyst_note":"","how_to_check":"- Open `chrome://extensions` or `about:addons` and look for Angular DevTools.\n- Check that its version is below `1.21.1`.","plain_action":"Update the Angular DevTools browser extension to version 1.21.1 or later, through chrome://extensions or about:addons.","product_name":"","needs_analyst":false,"not_affected_if":["extension-not-installed","version-1.21.1-or-later"],"who_is_affected":"Only people who have the Angular DevTools browser extension installed at a version from 1.20.0 up to but not including 1.21.1. Exposure requires visiting an untrusted page while other tabs are open; the attacker must guess a randomized tab ID, which the advisory calls impractical.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000815,"input_tokens":5290,"output_tokens":572,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-101897':7A,15A '-2026':6A,14A '-346':26B '-441':28B '-940':30B '/angular/angular/pull/70623)':356C '1':200C '1.20.0':210C '1.21.1':211C,280C,333C '2':215C '3':230C '70623':353C 'access':190C 'activ':214C 'addon':315C 'angular':1A,16A,19B,42B,88C,107C,163C,205C,238C,276C 'angular-devtool':18B 'angular/angular':352C 'approv':338C 'arbitrari':118C 'attach':49B,115C 'attack':139C,152C,198C,272C 'automat':289C 'avail':348C 'background':109C 'banner':61B,162C 'blind':267C 'breakpoint':127C 'browser':22B,44B,90C,119C,149C,156C,168C,207C,226C,341C 'browser-extens':21B 'cdp':126C 'check':318C 'chrome':24B,50B,103C,123C,160C,284C,290C 'chrome.debugger':116C 'chrome.runtime.sendmessage':236C 'click':305C,317C 'code':73B,184C 'complex':273C 'content':37B,99C 'credenti':197C 'credit':357C 'cross':193C 'cross-origin':192C 'cve':5A,13A 'cwe':25B,27B,29B 'd':366C 'data':77B 'debug':60B,161C,166C 'debugg':52B 'denial':81C,132C,143C 'devtool':2A,20B,43B,89C,108C,124C,164C,206C,239C,277C 'devtools':17A 'dinh':360C 'direct':112C 'dispatch':102C,234C 'display':158C 'dos':4A,146C 'ensur':294C 'escal':187C 'execut':136C,171C,185C 'exist':85C 'extens':23B,45B,91C,208C,288C,303C,342C 'firefox':31B,286C,307C 'forc':154C 'freez':65B,169C 'gear':323C 'ghsa':9A 'ghsa-r653-wxfp-pp9c':8A 'github.com':355C 'github.com/angular/angular/pull/70623)':354C 'guess':268C 'hidden':261C 'high':271C 'icon':324C 'id':255C 'impact':138C,141C 'impract':269C 'input':70B 'instal':212C 'interact':175C 'javascript':170C 'lab':364C 'later':282C 'latest':299C 'local':3A,131C,142C 'make':47B,266C 'malici':33B,232C,246C 'manual':293C,310C 'may':327C 'memori':195C 'messag':40B,105C 'must':248C 'navig':218C 'note':244C,325C 'obtain':249C 'open':178C,229C 'origin':194C 'page':35B,94C,223C,233C,247C,265C 'parti':98C 'patch':274C,350C 'pause/freeze':137C 'per':258C 'pp9c':12A 'pr':351C 'precondit':140C,199C 'prevent':173C 'privileg':186C 'protocol':125C 'r':365C 'r653':10A 'random':257C 'refer':349C 'remot':183C 'requir':270C 'respond':68B 'result':128C 'review':336C 'rollout':283C 'run':74B,297C 'runtim':104C 'script':38B,100C 'see':58B 'servic':83C,110C,134C,145C 'session':259C 'son':359C 'sondt':361C 'start':165C 'stolen':79B 'stop':67B 'store':343C 'tab':55B,64B,120C,135C,150C,179C,227C,254C 'tabid':243C,253C 'take':328C 'target':148C,237C,242C 'thai':358C 'third':97C 'third-parti':96C 'time':330C 'trigger':122C 'unauthor':189C 'untrust':92C,263C 'untrusted/malicious':221C 'updat':275C,287C,306C,311C,320C 'user':174C,291C,308C 'valid':251C 'vendor':344C 'version':209C,279C,300C,332C 'victim':57B,202C,217C,252C 'vinsoc':363C 'visit':302C,313C 'vulner':84C 'web':34B,93C,222C,264C 'worker':111C 'wxfp':11A","nicknames":[],"mitigations":[],"who_affected":"Only people who have the Angular DevTools browser extension installed at a version from 1.20.0 up to but not including 1.21.1. Exposure requires visiting an untrusted page while other tabs are open; the attacker must guess a randomized tab ID, which the advisory calls impractical.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"everyone","plain_action":"Update the Angular DevTools browser extension to version 1.21.1 or later, through chrome://extensions or about:addons.","pkeys":["angulardevtools","devtools"],"ptokens":["angular","devtools"],"labels":["angulardevtools","browserextension","chrome","cwe346","cwe441","cwe940","firefox","medium","other"],"campaign_type":null,"search_a":"'-101897':7A,15A '-2026':6A,14A 'angular':1A,16A 'cve':5A,13A 'devtool':2A 'devtools':17A 'dos':4A 'ghsa':9A 'ghsa-r653-wxfp-pp9c':8A 'local':3A 'pp9c':12A 'r653':10A 'wxfp':11A","search_b":"'-346':26B '-441':28B '-940':30B 'angular':19B,42B 'angular-devtool':18B 'attach':49B 'banner':61B 'browser':22B,44B 'browser-extens':21B 'chrome':24B,50B 'code':73B 'content':37B 'cwe':25B,27B,29B 'data':77B 'debug':60B 'debugg':52B 'devtool':20B,43B 'extens':23B,45B 'firefox':31B 'freez':65B 'input':70B 'make':47B 'malici':33B 'messag':40B 'page':35B 'respond':68B 'run':74B 'script':38B 'see':58B 'stolen':79B 'stop':67B 'tab':55B,64B 'victim':57B 'web':34B","search_c":"'/angular/angular/pull/70623)':356C '1':200C '1.20.0':210C '1.21.1':211C,280C,333C '2':215C '3':230C '70623':353C 'access':190C 'activ':214C 'addon':315C 'angular':88C,107C,163C,205C,238C,276C 'angular/angular':352C 'approv':338C 'arbitrari':118C 'attach':115C 'attack':139C,152C,198C,272C 'automat':289C 'avail':348C 'background':109C 'banner':162C 'blind':267C 'breakpoint':127C 'browser':90C,119C,149C,156C,168C,207C,226C,341C 'cdp':126C 'check':318C 'chrome':103C,123C,160C,284C,290C 'chrome.debugger':116C 'chrome.runtime.sendmessage':236C 'click':305C,317C 'code':184C 'complex':273C 'content':99C 'credenti':197C 'credit':357C 'cross':193C 'cross-origin':192C 'd':366C 'debug':161C,166C 'denial':81C,132C,143C 'devtool':89C,108C,124C,164C,206C,239C,277C 'dinh':360C 'direct':112C 'dispatch':102C,234C 'display':158C 'dos':146C 'ensur':294C 'escal':187C 'execut':136C,171C,185C 'exist':85C 'extens':91C,208C,288C,303C,342C 'firefox':286C,307C 'forc':154C 'freez':169C 'gear':323C 'github.com':355C 'github.com/angular/angular/pull/70623)':354C 'guess':268C 'hidden':261C 'high':271C 'icon':324C 'id':255C 'impact':138C,141C 'impract':269C 'instal':212C 'interact':175C 'javascript':170C 'lab':364C 'later':282C 'latest':299C 'local':131C,142C 'make':266C 'malici':232C,246C 'manual':293C,310C 'may':327C 'memori':195C 'messag':105C 'must':248C 'navig':218C 'note':244C,325C 'obtain':249C 'open':178C,229C 'origin':194C 'page':94C,223C,233C,247C,265C 'parti':98C 'patch':274C,350C 'pause/freeze':137C 'per':258C 'pr':351C 'precondit':140C,199C 'prevent':173C 'privileg':186C 'protocol':125C 'r':365C 'random':257C 'refer':349C 'remot':183C 'requir':270C 'result':128C 'review':336C 'rollout':283C 'run':297C 'runtim':104C 'script':100C 'servic':83C,110C,134C,145C 'session':259C 'son':359C 'sondt':361C 'start':165C 'store':343C 'tab':120C,135C,150C,179C,227C,254C 'tabid':243C,253C 'take':328C 'target':148C,237C,242C 'thai':358C 'third':97C 'third-parti':96C 'time':330C 'trigger':122C 'unauthor':189C 'untrust':92C,263C 'untrusted/malicious':221C 'updat':275C,287C,306C,311C,320C 'user':174C,291C,308C 'valid':251C 'vendor':344C 'version':209C,279C,300C,332C 'victim':202C,217C,252C 'vinsoc':363C 'visit':302C,313C 'vulner':84C 'web':93C,222C,264C 'worker':111C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-09-16T13:23:27+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:N/SI:L/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"ghsa-repo","external_id":"GHSA-r653-wxfp-pp9c","url":"https://github.com/angular/angular/security/advisories/GHSA-r653-wxfp-pp9c","severity":"medium","published_at":"2026-09-16T13:23:27+00:00","modified_at":"2026-09-28T17:17:38+00:00","first_seen_at":"2026-11-09T22:53:17+00:00","fetched_at":"2026-11-09T22:53:17+00:00","note":null},{"source":"nvd","external_id":"CVE-2026-101897","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-101897","severity":null,"published_at":"2026-10-14T16:17:29+00:00","modified_at":"2026-10-29T15:17:14+00:00","first_seen_at":"2026-11-09T23:10:12+00:00","fetched_at":"2026-11-09T23:10:12+00:00","note":null}],"documents":[{"id":110458,"url":"https://github.com/angular/angular/security/advisories/GHSA-r653-wxfp-pp9c","title":"Maintainer's advisory: github.com","kind":"vendor","source":"ghsa-repo","publisher":"vendor","text":null,"published_at":"2026-09-16T13:23:27+00:00","relation":"advisory","confidence":null,"note":"Maintainer's advisory: github.com"},{"id":111144,"url":"https://github.com/angular/angular/commit/7c053599c79a6ddd785a9bae33ff9fc7b355ea0d","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":111145,"url":"https://github.com/angular/angular/commit/cf492e8a372e2bbddb84987df12c33a52c23c72f","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"},{"id":111146,"url":"https://github.com/angular/angular/commit/e02c4d89bcf5da9af499e0dfbba8c29206976ab3","title":"Patch: github.com","kind":"other","source":"nvd","publisher":"vendor","text":null,"published_at":null,"relation":"fix","confidence":null,"note":"Patch: github.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}