Angular XSS Vulnerability Threatens Thousands of Web Applications

A high-severity XSS vulnerability (CVE-2026-32635) in Angular's runtime and compiler allows internationalized (i18n) attribute bindings (e.g., href, src, action) to bypass Angular's sanitization, enabling script injection that can lead to session hijacking, data exfiltration, and unauthorized actions; affected @angular/core and @angular/compiler versions include 17.0.0 through 22.0.0-next.2, with patches released for several branches and mitigations (blocking untrusted input, removing i18n tags, using DomSanitizer) recommended for unpatched installations, while versions 17 and 18 remain unpatched.