Homepage

Origin Validation Error Affecting angular.js package, versions *

Severity

 Recommended
low

Based on default assessment until relevant scores are available.

Threat Intelligence

EPSS
0.35% (29th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-DEBIAN12-ANGULARJS-21176342
  • published18 Oct 2026
  • disclosed14 Oct 2026
Report a new vulnerability Found a mistake?

Introduced: 14 Oct 2026

NewCVE-2026-101897  (opens in a new tab)
CWE-346  (opens in a new tab)
CWE-441  (opens in a new tab)
CWE-940  (opens in a new tab)

How to fix?

There is no fixed version for Debian:12 angular.js.

NVD Description

Note: Versions mentioned in the description apply only to the upstream angular.js package and not the angular.js package as distributed by Debian. See How to fix? for Debian:12 relevant fixed versions and status.

Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. From 1.20.0 until 1.21.1, the Angular DevTools background service worker accepts chrome.runtime.sendMessage runtime messages from untrusted web pages or third-party content scripts without adequately verifying the message source. An untrusted sender that obtains a valid randomized victim tabId can direct the extension to use chrome.debugger to attach to another browser tab and trigger Chrome DevTools Protocol breakpoints. This can display the debugging banner, pause JavaScript execution, and prevent interaction with the target tab, but it does not provide remote code execution, privilege escalation, or cross-origin access to memory or credentials. This issue is fixed in version 1.21.1.