CVE-2026-101897

Awaiting Analysis Awaiting Analysis - Queue

Angular DevTools Debugger Bypass via Untrusted Messages

Publication date: 2026-10-14

Last updated on: 2026-10-16

Assigner: GitHub, Inc.

Description

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. From 1.20.0 until 1.21.1, the Angular DevTools background service worker accepts chrome.runtime.sendMessage runtime messages from untrusted web pages or third-party content scripts without adequately verifying the message source. An untrusted sender that obtains a valid randomized victim tabId can direct the extension to use chrome.debugger to attach to another browser tab and trigger Chrome DevTools Protocol breakpoints. This can display the debugging banner, pause JavaScript execution, and prevent interaction with the target tab, but it does not provide remote code execution, privilege escalation, or cross-origin access to memory or credentials. This issue is fixed in version 1.21.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-16

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-101897

EUVD

EUVD-2026-101143

Affected Vendors & Products

Vendor	Product	Version / Range
angular	angular	< 22.2.0-rc.0
angular	DevTools	>= 1.20.0, < 1.21.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-940	The product establishes a communication channel to handle an incoming request that has been initiated by an actor, but it does not properly verify that the request is coming from the expected origin.
CWE-346	The product does not properly verify that the source of data or communication is valid.
CWE-441	The product receives a request, message, or directive from an upstream component, but the product does not sufficiently preserve the original source of the request before forwarding the request to an external actor that is outside of the product's control sphere. This causes the product to appear to be the source of the request, leading it to act as a proxy or other intermediary between the upstream component and the external actor.

Attack-Flow Graph

Executive Summary

This vulnerability affects Angular DevTools versions 1.20.0 to 1.21.1. It allows untrusted web pages or third-party scripts to send malicious messages to the extension's background service worker. The attacker can force the extension to attach a debugger to arbitrary browser tabs using the Chrome DevTools Protocol, causing those tabs to freeze or pause execution and display a debugging banner. This does not allow remote code execution or privilege escalation but disrupts user interaction with the affected tabs.

Detection Guidance

This vulnerability is specific to the Angular DevTools browser extension and cannot be detected via standard network or system commands. Users should check the installed version of the Angular DevTools extension in their browser's extension management system. If the version is between 1.20.0 and 1.21.0, the system is vulnerable.

Impact Analysis

If you use Angular DevTools versions 1.20.0 to 1.21.1, an attacker could potentially freeze your browser tabs by sending malicious messages to the extension. This would display a debugging banner and prevent interaction with the affected tabs. The attack requires the attacker to obtain a valid tab ID, which is randomized and difficult to guess, making blind exploitation impractical.

Compliance Impact

This vulnerability primarily causes a denial of service by freezing browser tabs through debugger attachment, which does not directly expose credentials or memory. However, it could disrupt access to sensitive data during active sessions, potentially impacting compliance with availability requirements in GDPR (Article 32) and HIPAA (Security Rule). The lack of remote code execution or data exfiltration limits direct regulatory violations but may still require incident reporting if service disruption affects protected data processing.

Mitigation Strategies

Update the Angular DevTools extension to version 1.21.1 or later through your browser's extension management system. This version includes fixes that validate message senders and prevent untrusted web pages from triggering debugger attachments.

Hi! I’m here to help you understand CVE-2026-101897. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70