Angular DevTools CVE-2026-101897

The victim must have the Angular DevTools browser extension (versions 1.20.0 through 1.21.0) installed and active in Chrome. The attacker must control an untrusted web page or third-party content script AND must have obtained a valid randomized victim tabId, which the extension uses as the only gate before the background service worker accepts a chrome.runtime.sendMessage and attaches chrome.debugger to the target tab. Limiting factors that reduce realistic risk: the randomized tabId requirement raises attack complexity (AC:H), user interaction is needed (UI:P), the extension is a developer-only tool rather than a production component, and the achievable effect is limited to pausing/freezing a single tab (availability) - not code execution, data theft, or cross-origin access.

This is a genuinely low-priority issue despite a medium CVSS 4.0 score of 5.1. The vendor-provided CVSS 4.0 vector (AV:N/AC:H/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:N/SI:L/SA:H) shows the real picture: although the attack vector is network-reachable and unauthenticated (PR:N), attack complexity is High (AC:H) because the attacker must first obtain a valid randomized victim tabId, and user interaction is required (UI:P). Critically, all vulnerable-system impacts are None and the only meaningful consequences are a Low subsequent-system integrity (SI:L) and High subsequent-system availability (SA:H) effect - i.e. a denial-of-service/annoyance against a single browser tab, not compromise. The vendor advisory explicitly states there is NO remote code execution, NO privilege escalation, and NO cross-origin access to memory or credentials, which directly contradicts the input Tags 'RCE' and 'Privilege Escalation' (see data_quality_flags). No EPSS score, CISA KEV listing, or POC was supplied, so there is no public exploit identified at time of analysis and no evidence of active exploitation. The combination of high attack complexity, availability-only impact, and a developer-tool attack surface makes this a low real-world risk that does not warrant emergency patching.

A developer running Angular DevTools (1.20.0-1.21.0) visits a malicious or compromised web page while another tab is open. The page, having obtained the victim's randomized tabId, sends a crafted chrome.runtime.sendMessage to the extension's background service worker, which attaches chrome.debugger to the target tab and triggers a Chrome DevTools Protocol breakpoint - freezing the tab's JavaScript and showing the debugging banner. No public exploit code was provided in the intelligence, so this is a plausible but unproven scenario; the required valid tabId and user interaction (UI:P) make opportunistic exploitation difficult.