High-Severity Angular XSS Flaw Bypasses Built-In Sanitization

A high-severity (CVSS 8.6) Cross-Site Scripting vulnerability (CVE-2026-32635) in Angular’s internationalization (i18n) handling can bypass built-in sanitization when security-sensitive attributes (e.g., `href`, `src`, `action`, `formaction`) are marked with the `i18n-` prefix and bound to unsanitized user input, potentially allowing session hijacking, data exfiltration, and unauthorized actions; Angular has released patches across major versions and recommends immediate updates, using `DomSanitizer`, and avoiding binding untrusted input to internationalized attributes.