Acer NitroSense CVE-2026-50228

Requires local access to a machine running Acer NitroSense (versions up to and including 5.2.63) where Chromium remote debugging is left enabled in the production build, exposing an Electron DevTools endpoint on localhost TCP port 9993. Exploitation is limited to local attackers: the port is bound to loopback and not remotely reachable, so an attacker must already have local (though unauthenticated to the debug port) code execution or shell access on the host. No user interaction and no authentication against the debug endpoint are needed once local access is obtained.

This is a moderate, locally-scoped risk rather than a remote emergency. The CVSS 4.0 vector (AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H) correctly captures a local, unauthenticated, low-complexity flaw with full high impact once triggered - the debug port binds to localhost TCP 9993, so it is not remotely reachable, which is the single biggest limiter. The vendor's own 6.1 score reflects that local vector; note a CVSS 3.1 mapping of the same impacts (S:U/C:H/I:H/A:H) would land near 7.8, so the '6.1' is a CVSS-4.0-versioning artifact, not a sign of low impact. The exploit-maturity metric E:U (unreported/unproven) aligns with there being no KEV listing, no EPSS score, and no POC in the provided data - no public exploit identified at time of analysis. Practically, exploitation requires an attacker to already have local code-execution or an unprivileged shell on the machine; the payoff is executing JavaScript in the privileged Electron application context, i.e. a local privilege/context escalation via a well-known Chromium-remote-debugging misconfiguration (CWE-489, leftover debug code in production). Real priority is LOW-to-MODERATE: legitimate weakness, trivially exploitable once local, but no remote reach and no evidence of exploitation.

A low-privileged user or malware already running on an Acer laptop connects to the Chromium remote-debugging endpoint left open on localhost:9993 by NitroSense, sends commands over the DevTools protocol to evaluate JavaScript in the privileged Electron process, and thereby runs arbitrary code in that application's context. No exploit code is publicly available (E:U), and the attack is confined to local access since the port is bound to loopback.