CVE-2026-50228

UNKNOWN

Description

An unauthenticated local attacker can connect to the Electron DevTools endpoint exposed by Acer NitroSense software (versions up to and including 5.2.63) on localhost TCP port 9993. Because Chromium remote debugging is enabled in the production application, the attacker can execute JavaScript in the privileged application context and achieve arbitrary code execution.

Timeline

Published:September 23rd, 2026 8:17 AM

Last modified:September 23rd, 2026 3:17 PM

CVSS Scoring

No CVSS v3 score available

Weaknesses (CWE)

CWE-489

References & Reports

Advisories, patches, and third-party reports

https://community.acer.com/en/kb/articles/20051

Source: NIST NVD · Data may lag official sources by up to one minute