CVE-2026-101897

A flaw of MODERATE severity was found in the Angular DevTools browser extension, which is distributed upstream via browser extension stores rather than as a Red Hat product. The extension's background service worker accepts chrome.runtime.sendMessage runtime messages from untrusted web pages or third-party content scripts without adequately verifying the sender. A remote attacker who obtains a valid victim tab identifier can direct the extension to use chrome.debugger to attach to another browser tab and trigger Chrome DevTools Protocol breakpoints, which displays the debugging banner, pauses JavaScript execution, and prevents interaction with the target tab, resulting in a denial of service. Exploitation requires user interaction and knowledge of a valid victim tabId, and the issue does not provide remote code execution, privilege escalation, or cross-origin access to memory or credentials. No Red Hat products are currently listed as affected by this flaw, as the Angular DevTools extension is not shipped by Red Hat.