# CVE-2025-66035: Angular HttpClient XSRF token leakage via protocol-relative URLs

Source: https://junglewise.ai/threats/cve-2025-66035-angular-httpclient-xsrf-token-leakage-via-protocol-relative-urls  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-11-26. Updated: 2026-09-25  
License: CC BY 4.0 with a link back

CVE-2025-66035 · Severity: high · CVSS 4 · Published 2025-11-26

Angular is a popular JavaScript framework used to build interactive web applications. Angular includes built-in protection against Cross-Site Request Forgery (CSRF) attacks by automatically managing security tokens. A flaw in this protection causes the framework to leak these tokens when applications send requests to protocol-relative URLs (URLs starting with //). An attacker can exploit this by tricking an application into sending a request to an attacker-controlled domain, capturing the security token, and then using it to perform unauthorized actions in the user's account.

Technologies: [Google Angular Common](https://junglewise.ai/threats/technologies/angular-common). Vendors: [Google](https://junglewise.ai/threats/vendors/google).

## Quick answers

**Is CVE-2025-66035 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2025-66035 being exploited in the wild.

**How severe is CVE-2025-66035?** High severity, with a CVSS score of 4, published 26 November 2025.

**Which products and versions are affected?** Google Angular Common < 19.2.16, >= 20.0.0-next.0 < 20.3.14, >= 21.0.0-next.0 < 21.0.1, <19.2.16, >=20.0.0-next.0, <20.3.14, >=21.0.0-next.0, <21.0.1.

**Is there a fix for CVE-2025-66035?** A patch was published on 2025-11-26: Patches released: 19.2.16, 20.3.14, 21.0.1 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-66035 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2025-66035?** Check whether you run Google Angular Common at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

The vulnerability is a credential leak in Angular's HttpClient XSRF interceptor. The interceptor determines whether a request is cross-origin by checking if the URL starts with a protocol (`http://` or `https://`). However, protocol-relative URLs starting with `//` are incorrectly classified as same-origin requests, causing the XSRF token to be included in the `X-XSRF-TOKEN` header. An attacker can trigger a state-changing request (e.g., POST) to a protocol-relative URL pointing to an attacker-controlled domain to capture the token. The vulnerability affects Angular versions prior to 19.2.16, 20.3.14, and 21.0.1. Patches correct the interceptor logic to properly identify protocol-relative URLs as absolute URLs and exclude them from XSRF token injection. The attack requires XSRF protection to be enabled and the ability to trigger the application to make an HTTP request to an attacker-controlled URL.

## Affected products

- Google @angular/common <19.2.16, >=20.0.0-next.0, <20.3.14, >=21.0.0-next.0, <21.0.1

## Identifiers

- CVE-2025-66035
- GHSA-58c5-g7wp-6w37

## Timeline

- 2025-11-26: disclosed
- 2025-11-26: patched: Patches released: 19.2.16, 20.3.14, 21.0.1

## References

- [https://github.com/angular/angular/security/advisories/GHSA-58c5-g7wp-6w37](https://github.com/angular/angular/security/advisories/GHSA-58c5-g7wp-6w37)
- [https://github.com/angular/angular/commit/0276479e7d0e280e0f8d26fa567d3b7aa97a516f](https://github.com/angular/angular/commit/0276479e7d0e280e0f8d26fa567d3b7aa97a516f)
- [https://github.com/angular/angular/commit/05fe6686a97fa0bcd3cf157805b3612033f975bc](https://github.com/angular/angular/commit/05fe6686a97fa0bcd3cf157805b3612033f975bc)
- [https://github.com/angular/angular/commit/3240d856d942727372a705252f7c8c115394a41e](https://github.com/angular/angular/commit/3240d856d942727372a705252f7c8c115394a41e)
- [https://cert-portal.siemens.com/productcert/html/ssa-253495.html](https://cert-portal.siemens.com/productcert/html/ssa-253495.html)
- [https://cert-portal.siemens.com/productcert/html/ssa-485750.html](https://cert-portal.siemens.com/productcert/html/ssa-485750.html)

## Related threats

- [Google Angular Denial of Service in formatDate and DatePipe](https://junglewise.ai/threats/cve-2026-54268-google-angular-denial-of-service-in-formatdate-and-datepipe)