Bug 2539111 (CVE-2026-50228) - CVE-2026-50228 Acer NitroSense V5: Acer NitroSense: Arbitrary code execution via Electron DevTools endpoint
Summary: CVE-2026-50228 Acer NitroSense V5: Acer NitroSense: Arbitrary code execution ...
Keywords:
Status: NEW
Alias: CVE-2026-50228
Product: Security Response
Classification: Other
Component: vulnerability-draft
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-09-23 07:42 UTC by OSIDB Bzimport
Modified: 2026-09-25 13:59 UTC (History)
0 users

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2026-09-23 07:42:53 UTC 
An unauthenticated local attacker can connect to the Electron DevTools endpoint exposed by Acer NitroSense software (versions up to and including 5.2.63) on localhost TCP port 9993. Because Chromium remote debugging is enabled in the production application, the attacker can execute JavaScript in the privileged application context and achieve arbitrary code execution.
Note You need to log in before you can comment on or make changes to this bug.