Search

Find a vulnerability

Search criteria

    2 vulnerabilities found for DevTools by angular

    CVE-2026-101897 (GCVE-0-2026-101897)

    Vulnerability from nvd – Published: 2026-10-14 15:03 – Updated: 2026-10-14 15:03
    VLAI
    Title
    Angular DevTools (Local DoS)
    Summary
    Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. From 1.20.0 until 1.21.1, the Angular DevTools background service worker accepts chrome.runtime.sendMessage runtime messages from untrusted web pages or third-party content scripts without adequately verifying the message source. An untrusted sender that obtains a valid randomized victim tabId can direct the extension to use chrome.debugger to attach to another browser tab and trigger Chrome DevTools Protocol breakpoints. This can display the debugging banner, pause JavaScript execution, and prevent interaction with the target tab, but it does not provide remote code execution, privilege escalation, or cross-origin access to memory or credentials. This issue is fixed in version 1.21.1.
    Severity
    5.1 (Medium)
    CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:N/SI:L/SA:H
    CWE
    • CWE-346 - Origin Validation Error
    • CWE-441 - Unintended Proxy or Intermediary ('Confused Deputy')
    • CWE-940 - Improper Verification of Source of a Communication Channel
    Assigner
    GitHub_M CNA under the mitre root
    CNA scorecard C 72/100 over 7658 records in the last 180 days details
    References
    Impacted products
    Vendor Product Version
    angular angular Affected: < 22.2.0-rc.0
    		Create a notification for this product.
    angular DevTools Affected: >= 1.20.0, < 1.21.1
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "angular",
          "vendor": "angular",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 22.2.0-rc.0"
            }
          ]
        },
        {
          "product": "DevTools",
          "vendor": "angular",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 1.20.0, \u003c 1.21.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. From 1.20.0 until 1.21.1, the Angular DevTools background service worker accepts chrome.runtime.sendMessage runtime messages from untrusted web pages or third-party content scripts without adequately verifying the message source. An untrusted sender that obtains a valid randomized victim tabId can direct the extension to use chrome.debugger to attach to another browser tab and trigger Chrome DevTools Protocol breakpoints. This can display the debugging banner, pause JavaScript execution, and prevent interaction with the target tab, but it does not provide remote code execution, privilege escalation, or cross-origin access to memory or credentials. This issue is fixed in version 1.21.1."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "HIGH",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "HIGH",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "LOW",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:N/SI:L/SA:H",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-346",
              "description": "CWE-346: Origin Validation Error",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-441",
              "description": "CWE-441: Unintended Proxy or Intermediary (\u0027Confused Deputy\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-940",
              "description": "CWE-940: Improper Verification of Source of a Communication Channel",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-14T15:03:36.405Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/angular/angular/security/advisories/GHSA-r653-wxfp-pp9c",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/angular/angular/security/advisories/GHSA-r653-wxfp-pp9c"
        },
        {
          "name": "https://github.com/angular/angular/pull/70623",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/angular/angular/pull/70623"
        },
        {
          "name": "https://github.com/angular/angular/commit/7c053599c79a6ddd785a9bae33ff9fc7b355ea0d",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/angular/angular/commit/7c053599c79a6ddd785a9bae33ff9fc7b355ea0d"
        },
        {
          "name": "https://github.com/angular/angular/commit/cf492e8a372e2bbddb84987df12c33a52c23c72f",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/angular/angular/commit/cf492e8a372e2bbddb84987df12c33a52c23c72f"
        },
        {
          "name": "https://github.com/angular/angular/commit/e02c4d89bcf5da9af499e0dfbba8c29206976ab3",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/angular/angular/commit/e02c4d89bcf5da9af499e0dfbba8c29206976ab3"
        }
      ],
      "source": {
        "advisory": "GHSA-r653-wxfp-pp9c",
        "discovery": "UNKNOWN"
      },
      "title": "Angular DevTools (Local DoS)"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-101897",
    "datePublished": "2026-10-14T15:03:36.405Z",
    "dateReserved": "2026-09-28T15:55:37.906Z",
    "dateUpdated": "2026-10-14T15:03:36.405Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

    CVE-2026-101897 (GCVE-0-2026-101897)

    Vulnerability from cvelistv5 – Published: 2026-10-14 15:03 – Updated: 2026-10-14 15:03
    VLAI
    Title
    Angular DevTools (Local DoS)
    Summary
    Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. From 1.20.0 until 1.21.1, the Angular DevTools background service worker accepts chrome.runtime.sendMessage runtime messages from untrusted web pages or third-party content scripts without adequately verifying the message source. An untrusted sender that obtains a valid randomized victim tabId can direct the extension to use chrome.debugger to attach to another browser tab and trigger Chrome DevTools Protocol breakpoints. This can display the debugging banner, pause JavaScript execution, and prevent interaction with the target tab, but it does not provide remote code execution, privilege escalation, or cross-origin access to memory or credentials. This issue is fixed in version 1.21.1.
    Severity
    5.1 (Medium)
    CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:N/SI:L/SA:H
    CWE
    • CWE-346 - Origin Validation Error
    • CWE-441 - Unintended Proxy or Intermediary ('Confused Deputy')
    • CWE-940 - Improper Verification of Source of a Communication Channel
    Assigner
    GitHub_M CNA under the mitre root
    CNA scorecard C 72/100 over 7658 records in the last 180 days details
    References
    Impacted products
    Vendor Product Version
    angular angular Affected: < 22.2.0-rc.0
    		Create a notification for this product.
    angular DevTools Affected: >= 1.20.0, < 1.21.1
    		Create a notification for this product.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "cna": {
      "affected": [
        {
          "product": "angular",
          "vendor": "angular",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 22.2.0-rc.0"
            }
          ]
        },
        {
          "product": "DevTools",
          "vendor": "angular",
          "versions": [
            {
              "status": "affected",
              "version": "\u003e= 1.20.0, \u003c 1.21.1"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. From 1.20.0 until 1.21.1, the Angular DevTools background service worker accepts chrome.runtime.sendMessage runtime messages from untrusted web pages or third-party content scripts without adequately verifying the message source. An untrusted sender that obtains a valid randomized victim tabId can direct the extension to use chrome.debugger to attach to another browser tab and trigger Chrome DevTools Protocol breakpoints. This can display the debugging banner, pause JavaScript execution, and prevent interaction with the target tab, but it does not provide remote code execution, privilege escalation, or cross-origin access to memory or credentials. This issue is fixed in version 1.21.1."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "HIGH",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 5.1,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "HIGH",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "LOW",
            "userInteraction": "PASSIVE",
            "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:N/SI:L/SA:H",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "NONE",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-346",
              "description": "CWE-346: Origin Validation Error",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-441",
              "description": "CWE-441: Unintended Proxy or Intermediary (\u0027Confused Deputy\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        },
        {
          "descriptions": [
            {
              "cweId": "CWE-940",
              "description": "CWE-940: Improper Verification of Source of a Communication Channel",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-14T15:03:36.405Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/angular/angular/security/advisories/GHSA-r653-wxfp-pp9c",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/angular/angular/security/advisories/GHSA-r653-wxfp-pp9c"
        },
        {
          "name": "https://github.com/angular/angular/pull/70623",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/angular/angular/pull/70623"
        },
        {
          "name": "https://github.com/angular/angular/commit/7c053599c79a6ddd785a9bae33ff9fc7b355ea0d",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/angular/angular/commit/7c053599c79a6ddd785a9bae33ff9fc7b355ea0d"
        },
        {
          "name": "https://github.com/angular/angular/commit/cf492e8a372e2bbddb84987df12c33a52c23c72f",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/angular/angular/commit/cf492e8a372e2bbddb84987df12c33a52c23c72f"
        },
        {
          "name": "https://github.com/angular/angular/commit/e02c4d89bcf5da9af499e0dfbba8c29206976ab3",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/angular/angular/commit/e02c4d89bcf5da9af499e0dfbba8c29206976ab3"
        }
      ],
      "source": {
        "advisory": "GHSA-r653-wxfp-pp9c",
        "discovery": "UNKNOWN"
      },
      "title": "Angular DevTools (Local DoS)"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-101897",
    "datePublished": "2026-10-14T15:03:36.405Z",
    "dateReserved": "2026-09-28T15:55:37.906Z",
    "dateUpdated": "2026-10-14T15:03:36.405Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}