Angular DevTools has a vulnerability in its background service worker that accepts chrome.runtime.sendMessage messages from untrusted web pages or third‑party content scripts without verifying the message source. An attacker with access to a valid randomized victim tabId can instruct the extension to use chrome.debugger to attach to another browser tab, trigger Chrome DevTools Protocol breakpoints, display the debugging banner, pause JavaScript execution, and prevent interaction. The flaw does not provide remote code execution, privilege escalation, or cross‑origin access to credentials, but it can cause a local denial of service by freezing the affected tab.

The issue exists in Angular DevTools versions 1.20.0 through 1.21.0 (inclusive). Versions 1.21.1 and later contain the patch.

With a CVSS score of 5.1 the vulnerability is considered moderate. The EPSS score is < 1%, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires the attacker to have a legitimate tab context and to send messages to the extension, making the attack vector local and not remotely exploitable from an unprivileged network or remote host. Therefore, while the potential impact is limited to freezing a single tab, the risk remains significant for users who rely on uninterrupted client‑side operation.