Read the docs
TI-2026-74071 Aliases CVE-2026-101897

Angular DevTools lets web pages pause other browser tabs

Priority LOW 23CWE-346Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Passive
Attack complexity
High
Attack requirements
None
Impact type
Security bypass
Confidentiality · integrity · availability
None · None · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-346.

Summary

Angular DevTools from 1.20.0 before 1.21.1 is affected. Its background service worker accepts runtime messages from untrusted web pages and third-party content scripts without verifying the sender (CWE-940). An attacker who obtains a valid randomized victim tab ID can make the extension attach the debugger to another tab, pausing JavaScript and blocking interaction. The flaw gives no remote code execution, privilege escalation, or cross-origin access to memory or credentials.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. From 1.20.0 until 1.21.1, the Angular DevTools background service worker accepts chrome.runtime.sendMessage runtime messages from untrusted web pages or third-party content scripts without adequately verifying the message source. An untrusted sender that obtains a valid randomized victim tabId can direct the extension to use chrome.debugger to attach to another browser tab and trigger Chrome DevTools Protocol breakpoints. This can display the debugging banner, pause JavaScript execution, and prevent interaction with the target tab, but it does not provide remote code execution, privilege escalation, or cross-origin access to memory or credentials. This issue is fixed in version 1.21.1.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00353 29th percentileScored 2026-11-07
Fix Fixed angular (angular): 22.2.0-rc.0DevTools (angular): 1.21.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
angularangularbefore 22.2.0-rc.022.2.0-rc.0Patch availableCNA
angularDevTools1.20.0 to before 1.21.11.21.1Patch availableCNA
  • angular Vendorangular Affected before 22.2.0-rc.0 Fixed in 22.2.0-rc.0 Patch available CNA
  • DevTools Vendorangular Affected 1.20.0 to before 1.21.1 Fixed in 1.21.1 Patch available CNA

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPEVersionsRoleVendor
cpe:2.3:a:angular:angular:*:*:*:*:*:*:*:*——angular
  • cpe:2.3:a:angular:angular:*:*:*:*:*:*:*:* Versions — — ·angular

Remediation

Update Angular DevTools to version 1.21.1 and the angular package to version 22.2.0-rc.0.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

  • Fix · CNA angular (angular) Fixed in 22.2.0-rc.0
  • Fix · CNA DevTools (angular) Fixed in 1.21.1

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-14 Threatist record created from CVE-2026-101897
  2. 2026-10-29 CISA SSVC decision points changed
  3. 2026-11-06 Affected versions changed · Red Hat
  4. 2026-11-06 CVSS score added · Red Hat

References

Other 5

  • TI-2026-74069 Infinite loop in Angular SSR HTML parser allows denial of service CVSS 4.0HIGH 8.7
  • TI-2026-60076 Angular: SSRF and Cross-Origin Credential Disclosure via URL Resolution Discrepancy in SSR CVSS 4.0HIGH 8.6
  • TI-2026-60080 Angular: SSR XSS via Unescaped <template> Content Across DocumentFragment Boundaries in Fallback Raw-Content Elements CVSS 4.0HIGH 8.6
  • TI-2026-60078 Angular: SSR XSS via Unescaped Processing Instruction (<?...?>) Nodes in Fallback Raw-Content Elements CVSS 4.0HIGH 8.6
  • TI-2025-38694 Server-Side Request Forgery (SSRF) in Angular SSR CVSS 4.0HIGH 8.7
  • TI-2026-22098 Angular SSR has an Open Redirect via X-Forwarded-Prefix CVSS 4.0MEDIUM 6.9
See all 46 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences