---
id: "CVE-2026-101897"
page: "https://infrastack.ai/live/CVE-2026-101897"
kind: "vulnerability"
aliases: ["CVE-2026-101897", "GHSA-r653-wxfp-pp9c"]
title: "Angular DevTools (Local DoS)"
severity: "medium"
cvss: 5.1
epss: null
exploited: false
status: "open"
category: "other"
products: [{"name": "Angular DevTools", "fixed": ["1.21.1"], "affected": ">= 1.20.0, < 1.21.1", "ecosystem": "other"}]
ecosystems: ["other"]
tags: ["angular-devtools", "browser-extension", "chrome", "cwe-346", "cwe-441", "cwe-940", "firefox", "other"]
not_affected_if: ["extension-not-installed", "version-1.21.1-or-later"]
published_at: "2026-09-16T13:23:27+00:00"
first_seen_at: "2026-11-09T22:53:17+00:00"
updated_at: "2026-11-09T23:01:11+00:00"
sources: [{"source": "ghsa-repo", "url": "https://github.com/angular/angular/security/advisories/GHSA-r653-wxfp-pp9c", "first_seen_at": "2026-11-09T22:53:17+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-101897", "first_seen_at": "2026-11-09T23:10:12+00:00"}]
exploit_sources: []
---

# Angular DevTools (Local DoS)

Link for people: https://infrastack.ai/live/CVE-2026-101897 (this .md is for agents)

A malicious web page or content script can message the Angular DevTools browser extension and make it attach Chrome's debugger to other tabs. The victim sees a debugging banner, and those tabs freeze or stop responding to input, but no code runs and no data is stolen.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- other:Angular DevTools affected >= 1.20.0, < 1.21.1 fixed 1.21.1

## How to check

- Open `chrome://extensions` or `about:addons` and look for Angular DevTools.
- Check that its version is below `1.21.1`.

## Fix

- Angular DevTools: update to `1.21.1` or later.

## Timeline

- 2026-11-09T22:53:17+00:00 ghsa-repo https://github.com/angular/angular/security/advisories/GHSA-r653-wxfp-pp9c
- 2026-11-09T23:10:12+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-101897

## Documents

- [advisory] Maintainer's advisory: github.com https://github.com/angular/angular/security/advisories/GHSA-r653-wxfp-pp9c
- [fix] Patch: github.com https://github.com/angular/angular/commit/7c053599c79a6ddd785a9bae33ff9fc7b355ea0d
- [fix] Patch: github.com https://github.com/angular/angular/commit/cf492e8a372e2bbddb84987df12c33a52c23c72f
- [fix] Patch: github.com https://github.com/angular/angular/commit/e02c4d89bcf5da9af499e0dfbba8c29206976ab3

## From the sources

A Denial of Service vulnerability exists in the Angular DevTools browser extension. Untrusted web pages or third-party content scripts can dispatch Chrome runtime messages to Angular DevTools' background service worker, directing it to attach `chrome.debugger` to arbitrary browser tabs and trigger Chrome DevTools Protocol (CDP) breakpoints, resulting in a local Denial of Service (tab execution pause/freeze).

### Impact & Attack Preconditions

**Impact:**
Local Denial of Service (DoS) of target browser tabs. An attacker can force the browser to display the Chrome debugging banner (*"Angular DevTools" started debugging this browser*), freeze JavaScript execution, and prevent user interaction on other open tabs. There is no remote code execution, privilege escalation, or unauthorized access to cross-origin memory or credentials.

**Attack Preconditions:**
1. The victim has the Angular DevTools browser extension (version >= 1.20.0, < 1.21.1) installed and active.
2. The victim navigates to an untrusted/malicious web page while other browser tabs are open.
3. The malicious page dispatches a `chrome.runtime.sendMessage` targeting Angular DevTools with a target `tabId`.
   * **Note:** The malicious page must obtain a valid victim `tabId`. Tab IDs are randomized per session and hidden from untrusted web pages, making blind guessing impractical (requiring High Attack Complexity).

### Patches
Update Angular DevTools to version **1.21.1** or later.

### Rollout
Chrome and Firefox update extensions automatically.
- **Chrome users:** Can manually ensure they are running the latest version by visiting `chrome://extensions` and clicking **Update**.
- **Firefox users:** Can manually update by visiting `about:addons` and clicking **Check for Updates** under the gear icon.

*Note: It may take some time for version 1.21.1 to be reviewed and approved by each browser extension store vendor before it is available.*

### References
* Patch PR: [angular/angular#70623](https://github.com/angular/angular/pull/70623)

### Credits
- Thai Son Dinh (sondt) from VinSOC Labs (R&D)

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_