A Denial of Service vulnerability exists in the Angular DevTools browser extension. Untrusted web pages or third-party content scripts can dispatch Chrome runtime messages to Angular DevTools' background service worker, directing it to attach "chrome.debugger" to arbitrary browser tabs and trigger Chrome DevTools Protocol (CDP) breakpoints, resulting in a local Denial of Service (tab execution pause/freeze). ### Impact & Attack Preconditions Impact: Local Denial of Service (DoS) of target browser tabs. An attacker can force the browser to display the Chrome debugging banner ("Angular DevTools" started debugging this browser), freeze JavaScript execution, and prevent user interaction on other open tabs. There is no remote code execution, privilege escalation, or unauthorized access to cross-origin memory or credentials. Attack Preconditions: 1. The victim has the Angular DevTools browser extension (version >= 1.20.0, < 1.21.1) installed and active. 2. The victim navigates to an untrusted/malicious web page while other browser tabs are open. 3. The malicious page dispatches a "chrome.runtime.sendMessage" targeting Angular DevTools with a target "tabId". * Note: The malicious page must obtain a valid victim "tabId". Tab IDs are randomized per session and hidden from untrusted web pages, making blind guessing impractical (requiring High Attack Complexity). ### Patches Update Angular DevTools to version 1.21.1 or later. ### Rollout Chrome and Firefox update extensions automatically. - Chrome users: Can manually ensure they are running the latest version by visiting "chrome://extensions" and clicking Update. - Firefox users: Can manually update by visiting "about:addons" and clicking Check for Updates under the gear icon. Note: It may take some time for version 1.21.1 to be reviewed and approved by each browser extension store vendor before it is available. ### References * Patch PR: "angular/angular#70623" (https://github.com/angular/angular/pull/70623) ### Credits - Thai Son Dinh (sondt) from VinSOC Labs (R&D)