Devtools
Monthly
Angular DevTools versions 1.20.0 through 1.21.0 accept chrome.runtime.sendMessage traffic in their background service worker without adequately validating the message sender, so an untrusted web page or third-party content script that has learned a victim tab's randomized tabId can instruct the extension to attach chrome.debugger to that tab and trigger Chrome DevTools Protocol breakpoints, pausing JavaScript execution and blocking interaction with the page. The achievable impact is confined to a tab-level denial of service: displaying the debugging banner and freezing a single tab, with no remote code execution, privilege escalation, or cross-origin access to memory or credentials, and no public exploit has been identified at time of analysis. Per the assessed CVSS vector the issue is unauthenticated (PR:N), but exploitation is gated by the high-complexity randomized-tabId precondition and victim interaction; version 1.21.1 resolves it.
A vulnerability in Nuxt DevTools has been fixed in version **2.6.4***. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required. Public exploit code available.
The Vue.js Devtools extension was found to leak screenshot data back to a malicious web page via the standard `postMessage()` API. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Angular DevTools versions 1.20.0 through 1.21.0 accept chrome.runtime.sendMessage traffic in their background service worker without adequately validating the message sender, so an untrusted web page or third-party content script that has learned a victim tab's randomized tabId can instruct the extension to attach chrome.debugger to that tab and trigger Chrome DevTools Protocol breakpoints, pausing JavaScript execution and blocking interaction with the page. The achievable impact is confined to a tab-level denial of service: displaying the debugging banner and freezing a single tab, with no remote code execution, privilege escalation, or cross-origin access to memory or credentials, and no public exploit has been identified at time of analysis. Per the assessed CVSS vector the issue is unauthenticated (PR:N), but exploitation is gated by the high-complexity randomized-tabId precondition and victim interaction; version 1.21.1 resolves it.
A vulnerability in Nuxt DevTools has been fixed in version **2.6.4***. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required. Public exploit code available.
The Vue.js Devtools extension was found to leak screenshot data back to a malicious web page via the standard `postMessage()` API. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.