Google Vulnerabilities and Affected Products
Vulnerabilities associated with AngularJS.
Products
Clear product- Chrome4,306 vulnerabilities
- Android1,376 vulnerabilities
- pixel56 vulnerabilities
- Chromium V839 vulnerabilities
- ChromeOS12 vulnerabilities
- android_kernel6 vulnerabilities
- AngularJS6 vulnerabilities
- Chromium6 vulnerabilities
- gRPC6 vulnerabilities
- MCP Toolbox for Databases (googleapis/mcp-toolbox)6 vulnerabilities
- mcp-toolbox5 vulnerabilities
- gVisor4 vulnerabilities
- Keras4 vulnerabilities
- Nearby3 vulnerabilities
- admob2 vulnerabilities
- Andrioid2 vulnerabilities
- Chromium Blink2 vulnerabilities
- Chromium Intents2 vulnerabilities
- Chromium Mojo2 vulnerabilities
- Chromium Skia2 vulnerabilities
- Fuchsia2 vulnerabilities
- libjxl2 vulnerabilities
- MCP Toolbox for Databases2 vulnerabilities
- Nest Wifi Pro2 vulnerabilities
- Omaha2 vulnerabilities
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2026-11998HIGH | AngularJS XSS via SCE resource URL sanitization bypassA flaw in AngularJS' Strict Contextual Escaping (SCE) logic allows bypassing certain SCE policies for resource URLs and can lead to arbitrary JavaScript execution within the context of the victim's browser session. SCE's purpose is to ensure that only trusted or safe values are used in certain security-sensitive contexts, such as resource URLs, including URLs that define executable JavaScript scripts, '<iframe>' documents, route templates, etc. A flaw in the logic that tries to match entire UR… | CVSS7.6v3.1 | EPSS0.333% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2025-4690MEDIUM | AngularJS 'linky' filter ReDoSA regular expression used by AngularJS' linky https://docs.angularjs.org/api/ngSanitize/filter/linky filter to detect URLs in input text is vulnerable to super-linear runtime due to backtracking. With a large carefully-crafted input, this can cause a Regular expression Denial of Service (ReDoS) https://owasp.org/www-community/attacks/Regular_expression_Denial_of_Service_-_ReDoS attack on the application. This issue affects all versions of AngularJS. Note: The AngularJS project is End-of-… CWE-1333Aug 19, 2025 | CVSS4.3v3.1 | EPSS0.204% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
CVE-2025-2336MEDIUM | AngularJS improper sanitization in SVG '<image>' element with 'ngSanitize'Improper sanitization of the value of the 'href' and 'xlink:href' attributes in '<image>' SVG elements in AngularJS's 'ngSanitize' module allows attackers to bypass common image source restrictions. This can lead to a form of Content Spoofing https://owasp.org/www-community/attacks/Content_Spoofing and also negatively affect the application's performance and behavior by using too large or slow-to-load images. This issue affects AngularJS versions greater than or equal to 1.3.1. Note: The Ang… CWE-791Jun 4, 2025 | CVSS4.8v3.1 | EPSS0.302% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |
AngularJS improper sanitization in SVG '<image>' elementImproper sanitization of the value of the 'href' and 'xlink:href' attributes in '<image>' SVG elements in AngularJS allows attackers to bypass common image source restrictions. This can lead to a form of Content Spoofing https://owasp.org/www-community/attacks/Content_Spoofing and also negatively affect the application's performance and behavior by using too large or slow-to-load images. This issue affects all versions of AngularJS. Note: The AngularJS project is End-of-Life and will not rec… CWE-791Apr 29, 2025 | CVSS-v4.0 | EPSS0.381% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX | |
AngularJS improper sanitization in '<source>' elementImproper sanitization of the value of the [srcset] attribute in <source> HTML elements in AngularJS allows attackers to bypass common image source restrictions, which can also lead to a form of Content Spoofing https://owasp.org/www-community/attacks/Content_Spoofing . This issue affects all versions of AngularJS. Note: The AngularJS project is End-of-Life and will not receive any updates to address this issue. For more information see here https://docs.angularjs.org/misc/version-support-sta… CWE-791Sep 9, 2024 | CVSS-v4.0 | EPSS0.599% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX | |
AngularJS improper sanitization in 'srcset' attributeImproper sanitization of the value of the 'srcset' attribute in AngularJS allows attackers to bypass common image source restrictions, which can also lead to a form of Content Spoofing https://owasp.org/www-community/attacks/Content_Spoofing . This issue affects AngularJS versions 1.3.0-rc.4 and greater. Note: The AngularJS project is End-of-Life and will not receive any updates to address this issue. For more information see here https://docs.angularjs.org/misc/version-support-status . CWE-1289Sep 9, 2024 | CVSS-v4.0 | EPSS0.574% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |