CVE-2026-50228CWE-489

CVE-2026-50228

published September 23, 2026

CVSS
6.1
EPSS
0%
Percentile
2.6
In the wild
Unconfirmed
What it is

An unauthenticated local attacker can connect to the Electron DevTools endpoint exposed by Acer NitroSense software (versions up to and including 5.2.63) on localhost TCP port 9993. Because Chromium remote debugging is enabled in the production application, the attacker can execute JavaScript in the privileged application context and achieve arbitrary code execution.

The record
Technical detail
CVSS
6.1 · NONE
CVSS v4.0
6.1 · CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U
EPSS
0.00134 · 2.6th percentile
Weakness
CWE-489 · Active Debug Code
Published
2026-09-23T12:17Z
References (1)
https://community.acer.com/en/kb/articles/20051 · 8fc372e3-d9c5-46e4-9410-38469745c639
EPSS history
Timeline
  • 24 SEP 03:23Z
    EPSS moved — → 0%
    epss
  • 23 SEP 07:20Z
    Electron DevTools Arbitrary Code Execution Vulnerability in NitroSense
    cvelistv5