🚨 Angular XSS Vulnerability Puts Thousands of Web Apps at Risk

A high-severity vulnerability in Angular—one of the most widely used web frameworks—has been identified, exposing thousands of web applications to Cross-Site Scripting (XSS) attacks.

Tracked as CVE-2026-32635, this flaw allows attackers to bypass Angular’s built-in security protections and inject malicious scripts directly into web applications.

And here’s the kicker… it doesn’t require some exotic exploit chain.
Just a subtle misuse of a feature developers rely on every day.

⚠️ The Problem: A Hidden Blind Spot in Angular

Angular is designed to automatically sanitize inputs, protecting applications from malicious code execution.

But this vulnerability creates a dangerous loophole.

When developers combine:

• sensitive HTML attributes (like href, src, action)

• with Angular’s internationalization (i18n) features

…the framework’s sanitization can be completely bypassed.

In simple terms:

👉 Add an i18n-* attribute to certain elements
👉 Bind it to untrusted input
👉 Angular skips security checks

Game over.

🎯 What Attackers Can Do

Once exploited, attackers can execute malicious JavaScript inside a user’s browser—under your domain.

That’s not just annoying. That’s full trust abuse.

Here’s what that opens up:

🧠 Session Hijacking

Steal cookies and authentication tokens → take over user accounts.

📤 Data Exfiltration

Capture sensitive data and send it to attacker-controlled servers.

🎭 Unauthorized Actions

Trigger actions as the victim (payments, changes, approvals… you name it).

🧨 Why This Is Dangerous

This vulnerability has:

• Low attack complexity

• Network-based exploitation

• High impact on user trust and data security

And it targets attributes developers use constantly:

• href

• src

• action

• background

• data

• formaction

So yeah… this isn’t edge-case territory. This is core app behavior.

📦 Affected Versions

The vulnerability impacts:

• @angular/core

• @angular/compiler

Across versions:

👉 17.0.0 → 22.0.0-next.2

✅ Patched Versions

Upgrade immediately to:

• 22.0.0-next.3

• 21.2.4

• 20.3.18

• 19.2.20

❌ Still Vulnerable

• Angular 17 & 18 (no patch yet)

If you’re running those… you’re in mitigation mode, not comfort mode.

🛡 How to Protect Your Applications

If you can patch—do it now. No debate.

If you can’t, here’s how you stay out of trouble:

🚫 Block Untrusted Input

Never bind user-controlled data directly to sensitive attributes.

That includes:

• user input

• database content

• API responses

• URL parameters

🧹 Remove i18n from Risky Attributes

If an attribute uses untrusted data, do not mark it for internationalization.

That combo is the vulnerability trigger.

🔒 Enforce Manual Sanitization

Use Angular’s DomSanitizer explicitly.

Don’t rely on automatic protection—it’s clearly not bulletproof here.

🎯 Security Takeaway

Frameworks are supposed to make you safer.

But sometimes… the features meant to help you scale are the same ones that quietly open the door.

This isn’t just an Angular issue.

It’s a reminder:

👉 Assume nothing is automatically secure
👉 Validate everything—even “safe” framework behavior

Because attackers don’t break systems the loud way anymore.

They slip through the tiny cracks you didn’t think mattered.