Is CVE-2026-101897 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-101897 being exploited in the wild.

How severe is CVE-2026-101897?

Informational severity, published 14 October 2026.

Which products and versions are affected?

Angular DevTools 1.20.0 to 1.21.0.

How is CVE-2026-101897 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-101897?

Check whether you run Angular DevTools at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-101897: Angular DevTools extension message validation bypass

CVE-2026-101897 · Severity: info · Published 2026-10-14

Angular DevTools is a browser extension that helps developers debug web applications. The extension failed to properly verify that browser messages came from trusted sources, allowing a malicious website to send commands that would trigger debugging features in another tab. While this cannot steal data or run code, it could disrupt the user's browsing by pausing the JavaScript execution of a target website and displaying debugging overlays.

Vendors: Angular.

Quick answers

Is CVE-2026-101897 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-101897 being exploited in the wild.
How severe is CVE-2026-101897?: Informational severity, published 14 October 2026.
Which products and versions are affected?: Angular DevTools 1.20.0 to 1.21.0.
Is there a fix for CVE-2026-101897?: Yes: fixed in 1.21.1. Until then: Upgrade Angular DevTools to version 1.21.1 or later, which adds proper validation of message senders (sender.id, sender.origin, sender.url) and ensures sender.tab is undefined to prevent content script messages from being processed. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-101897 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-101897?: Check whether you run Angular DevTools at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 1.21.1

Upgrade Angular DevTools to version 1.21.1 or later, which adds proper validation of message senders (sender.id, sender.origin, sender.url) and ensures sender.tab is undefined to prevent content script messages from being processed.

Technical details

The Angular DevTools background service worker accepted chrome.runtime.sendMessage messages without validating the sender's origin, allowing untrusted web pages or third-party content scripts to send messages if they could determine a valid victim tab ID. An attacker could trigger chrome.debugger attachment and set breakpoints via Chrome DevTools Protocol, causing the debugging banner to display and JavaScript execution to pause, but without achieving RCE, privilege escalation, or memory/credential access.

Affected products

Angular DevTools 1.20.0 to 1.21.0

Timeline

2026-10-14: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.