CVE-2026-32635: Angular Framework XSS Vulnerability

CVE-2026-32635 Overview

A Cross-Site Scripting (XSS) vulnerability has been identified in the Angular runtime and compiler that allows attackers to bypass Angular's built-in sanitization mechanism. The vulnerability occurs when applications use security-sensitive attributes (such as href on anchor tags) together with Angular's internationalization (i18n) feature. By enabling internationalization for sensitive attributes using the i18n-<attribute> naming convention combined with data binding to untrusted user-generated content, attackers can inject malicious scripts into the application.

Critical Impact

This vulnerability enables attackers to execute arbitrary JavaScript in the context of affected Angular applications, potentially leading to session hijacking, credential theft, and unauthorized actions on behalf of authenticated users.

Affected Products

• Angular versions prior to 22.0.0-next.3
• Angular versions prior to 21.2.4
• Angular versions prior to 20.3.18
• Angular versions prior to 19.2.20

Discovery Timeline

• 2026-03-16 - CVE CVE-2026-32635 published to NVD
• 2026-03-16 - Last updated in NVD database

Technical Details for CVE-2026-32635

Vulnerability Analysis

This vulnerability is classified as CWE-79 (Cross-Site Scripting). The flaw resides in how Angular handles the intersection of its security-sensitive attribute sanitization and its internationalization (i18n) system. Angular normally sanitizes potentially dangerous attributes like href, src, and similar properties to prevent injection attacks. However, when developers mark these attributes for internationalization using the i18n-<attribute> directive, the sanitization process is inadvertently bypassed.

The attack requires user interaction and low-privilege access, but can be exploited remotely over the network. When successfully exploited, an attacker can achieve high impact on confidentiality, integrity, and availability within the vulnerable application's context.

Root Cause

The root cause lies in Angular's template compiler and runtime handling of internationalized attributes. When an attribute is marked for internationalization (e.g., i18n-href), the normal sanitization pipeline that would ordinarily inspect and sanitize security-sensitive attributes is bypassed. This creates a gap where untrusted data bound to these internationalized attributes flows directly into the DOM without proper security validation.

Attack Vector

The attack requires an Angular application that:

1. Uses security-sensitive attributes (like href, src, or action) on HTML elements
2. Enables internationalization on these attributes using the i18n-<attribute> directive
3. Binds these attributes to user-controllable data

An attacker can craft malicious input containing JavaScript payloads that, when bound to an internationalized sensitive attribute, execute in the victim's browser context. This is a network-based attack vector requiring some user interaction to trigger the malicious payload.

The vulnerability mechanism involves the internationalization directive creating a path that circumvents Angular's DomSanitizer service. When an attribute like href is marked with i18n-href, the template compiler treats the attribute value as translatable content rather than security-sensitive input, allowing schemes like javascript: to pass through unsanitized. See the GitHub Security Advisory for detailed technical information.

Detection Methods for CVE-2026-32635

Indicators of Compromise

• Presence of unusual or malicious javascript: URIs in application logs or user input fields
• Unexpected script execution events in browser developer tools or client-side monitoring
• Reports of session hijacking or unauthorized actions from authenticated users
• Detection of encoded payloads in URL parameters or form inputs targeting i18n-enabled attributes

Detection Strategies

• Audit Angular templates for combinations of i18n-<attribute> directives with security-sensitive attributes (href, src, action, formaction)
• Implement Content Security Policy (CSP) headers to detect and block inline script execution attempts
• Deploy web application firewalls (WAF) with rules to identify XSS payload patterns in request parameters
• Use static code analysis tools to identify potentially vulnerable template patterns

Monitoring Recommendations

• Enable detailed logging for client-side JavaScript errors and security violations
• Monitor CSP violation reports for blocked script execution attempts
• Implement real-time alerting for unusual patterns in user-submitted content containing script tags or JavaScript URIs
• Track and review any anomalous authentication or session behavior that may indicate successful exploitation

How to Mitigate CVE-2026-32635

Immediate Actions Required

• Upgrade Angular to one of the patched versions: 22.0.0-next.3, 21.2.4, 20.3.18, or 19.2.20
• Audit existing codebase for usage of i18n-<attribute> on security-sensitive attributes
• Remove internationalization directives from security-sensitive attributes until patches are applied
• Implement strict Content Security Policy headers to reduce the impact of potential XSS attacks

Patch Information

Angular has released security patches addressing this vulnerability across multiple supported versions. The fixes are available in the following releases:

The patches are documented in Pull Request #67541 and Pull Request #67561. Organizations should update to the appropriate patched version for their Angular version branch.

Workarounds

• Avoid using i18n-<attribute> directives on security-sensitive attributes (href, src, action, formaction) until patched
• Manually sanitize user input before binding to any attribute that may be internationalized
• Use Angular's DomSanitizer service explicitly when handling dynamic URLs or other sensitive values
• Implement server-side validation and sanitization as a defense-in-depth measure

# Update Angular to patched version using npm
npm update @angular/core @angular/compiler @angular/platform-browser

# Or specify exact patched version (example for 21.x branch)
npm install @angular/core@21.2.4 @angular/compiler@21.2.4 @angular/platform-browser@21.2.4