Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-101897— Angular DevTools (Local DoS)

Quick assessment

Affected
angular angular
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Angular 是一个用于使用 TypeScript/JavaScript 及其他语言构建移动和桌面 Web 应用的开发平台。在版本 1.20.0 至 1.21.1 期间，Angular DevTools 的背景服务 worker 会从不受信任的网页或第三方内容脚本接收 chrome.runtime.sendMessage 运行时消息，而未充分验证消息来源。若攻击者获取到一个有效的随机受害者标签页 ID（tabId），便可使扩展程序使用 chrome.debugger 附加到另一个浏览器标签页，并触发 Chrome

CVSS 5.1 · Medium EPSS 0.37% · P30

Affected Version Matrix 2

VendorProduct Version RangeStatus
angular angular < 22.2.0-rc.0 affected
angular DevTools >= 1.20.0, < 1.21.1 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-101897

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Angular DevTools (Local DoS)
Source: CVE Program / CVE List V5
Vulnerability Description
Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. From 1.20.0 until 1.21.1, the Angular DevTools background service worker accepts chrome.runtime.sendMessage runtime messages from untrusted web pages or third-party content scripts without adequately verifying the message source. An untrusted sender that obtains a valid randomized victim tabId can direct the extension to use chrome.debugger to attach to another browser tab and trigger Chrome DevTools Protocol breakpoints. This can display the debugging banner, pause JavaScript execution, and prevent interaction with the target tab, but it does not provide remote code execution, privilege escalation, or cross-origin access to memory or credentials. This issue is fixed in version 1.21.1.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:N/SI:L/SA:H
Source: CVE Program / CVE List V5
Vulnerability Type
源验证错误
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
angular angular < 22.2.0-rc.0 -
angular DevTools >= 1.20.0, < 1.21.1 -

II. Public POCs for CVE-2026-101897

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-101897

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-101897 (3)

Other References for CVE-2026-101897 (1)

Same Patch Batch · angular · 2026-10-14 · 3 CVEs total

CVE-2026-101895 8.7 HIGH Angular SSR: Denial of Service (DoS) via Infinite Loop on Malformed DOCTYPE
CVE-2026-101896 8.2 HIGH Angular: Denial of Service via Numeric URL Matrix Parameters in Server-Side Rendering (SSR

IV. Related Vulnerabilities

Same product: angular
Same vendor: angular
Same weakness: CWE-346

V. Comments for CVE-2026-101897

No comments yet

Leave a comment