CVE-2026-11998: AngularJS SCE Bypass XSS Vulnerability

CVE-2026-11998 Overview

CVE-2026-11998 is a Strict Contextual Escaping (SCE) bypass in AngularJS that allows attackers to execute arbitrary JavaScript in a victim's browser session. The flaw exists in the URL matching logic that validates resource URLs against developer-defined regular expression allowlists. Certain regex patterns produce partial matches instead of full-string matches, allowing unsafe values to pass SCE policy checks. Attackers can supply crafted URLs used by <iframe> elements, executable script tags, or route templates to deliver malicious payloads. The vulnerability affects all AngularJS releases from 1.2.0-rc.3 onward. AngularJS reached End-of-Life before publication of this CVE, and no upstream patch will be released.

Critical Impact
A successful exploit results in arbitrary JavaScript execution in the victim's browser, enabling session hijacking, credential theft, and full client-side compromise of AngularJS applications.

Affected Products

AngularJS versions >= 1.2.0-rc.3 (all subsequent releases)
Web applications relying on AngularJS $sce service for resource URL trust policies
Legacy applications still running AngularJS after its official End-of-Life

Discovery Timeline

2026-06-24 - CVE-2026-11998 published to NVD
2026-06-25 - Last updated in NVD database

Technical Details for CVE-2026-11998

Vulnerability Analysis

AngularJS exposes the Strict Contextual Escaping service ($sce) to ensure that only trusted values are bound to security-sensitive contexts. These contexts include resource URLs used for <script src>, <iframe src>, ng-include, route templates, and other locations where the URL controls executable content. Developers register allowlists through $sceDelegateProvider.trustedResourceUrlList() (formerly resourceUrlWhitelist()), typically using regular expressions to permit specific origins or paths.

The flaw resides in how AngularJS compares candidate URLs against these regex matchers. The matching routine does not consistently anchor the regex to the start and end of the URL string. As a result, regex patterns that lack explicit ^ and $ anchors return partial matches, which AngularJS treats as full matches. An attacker who controls any portion of the URL string can construct a value that contains a legitimate substring matching the allowlist while pointing to attacker-controlled content elsewhere in the URL.

The issue is classified under [CWE-791: Incomplete Filtering of Special Elements]. Exploitation requires user interaction, but the attack vector is network-based and requires no authentication or elevated privileges on the target application.

Root Cause

The SCE validation logic relies on regex .test() or .exec() calls against developer-supplied patterns without enforcing full-string anchoring. When a pattern matches any substring of the candidate URL, the URL is incorrectly classified as trusted. Because allowlists in real-world applications frequently omit ^ and $ or use loose path matchers, the bypass surface is broad.

Attack Vector

An attacker delivers a crafted URL through any input bound to a resource URL context, such as a query parameter consumed by ng-src, ng-include, or a router template. The malicious URL embeds a substring that satisfies the application's resource URL allowlist while the effective target is an attacker-controlled host. When AngularJS resolves the URL, it loads attacker-supplied script content into the victim's browsing context.

The vulnerability mechanism is documented by HeroDevs with a working proof-of-concept. See the CodePen Security Demonstration and the HeroDevs CVE-2026-11998 Listing for technical details and reproduction steps.

Detection Methods for CVE-2026-11998

Indicators of Compromise

Outbound browser requests to unexpected hosts originating from <iframe>, <script>, or ng-include directives in AngularJS applications
Unusual entries in $sce-protected URL parameters containing concatenated or encoded external domains alongside expected allowlist tokens
Browser console errors or content-security-policy violations referencing dynamically loaded script resources

Detection Strategies

Audit application source for calls to $sceDelegateProvider.trustedResourceUrlList() or resourceUrlWhitelist() and flag any regex pattern lacking ^ start and $ end anchors
Inspect server-side access logs for query parameters that contain URL-like substrings paired with attacker-controlled hosts when the application proxies or reflects resource URLs
Deploy web application firewall rules to identify resource URL parameters containing multiple protocol handlers or embedded external hostnames

Monitoring Recommendations

Enable Content Security Policy (CSP) reporting endpoints to capture script-src and frame-src violations indicating attempted SCE bypass
Monitor client-side telemetry for unexpected script load origins on pages built with AngularJS
Correlate browser-side errors with server-side parameter values to identify exploitation attempts in progress

How to Mitigate CVE-2026-11998

Immediate Actions Required

Inventory all production and internal applications that still depend on AngularJS and identify those using $sce resource URL allowlists
Rewrite every regex passed to trustedResourceUrlList() to include explicit ^ and $ anchors that match the entire URL string
Replace regex-based allowlists with exact string matches where possible to eliminate the partial-match attack surface
Plan migration off AngularJS, which is End-of-Life and will not receive a vendor patch

Patch Information

No upstream patch is available. The AngularJS project reached End-of-Life prior to CVE publication, as documented in the AngularJS Version Support Status announcement. Organizations requiring continued support can evaluate the HeroDevs Never-Ending Support for AngularJS offering, which provides backported fixes for legacy AngularJS deployments.

Workarounds

Anchor every resource URL allowlist regex with ^ and $ to force full-string matching
Deploy a strict Content Security Policy that restricts script-src, frame-src, and object-src to known origins, reducing exploit impact
Sanitize and validate any user-controlled input before binding it to AngularJS directives that resolve resource URLs
Prioritize migration to a supported framework such as Angular to eliminate ongoing exposure to unpatched AngularJS issues

bash

# Configuration example: anchor SCE resource URL allowlist patterns
# Vulnerable pattern (partial match permitted)
#   /https:\/\/trusted\.example\.com\//
# Hardened pattern (full-string match enforced)
#   /^https:\/\/trusted\.example\.com\/.*$/

# Example AngularJS configuration
# app.config(['$sceDelegateProvider', function($sceDelegateProvider) {
#   $sceDelegateProvider.trustedResourceUrlList([
#     'self',
#     /^https:\/\/trusted\.example\.com\/.*$/
#   ]);
# }]);