Junglewise Threat Intelligence

CVE-2026-27970: Google Angular XSS in internationalization ICU messages

CVE-2026-27970 · Severity: medium · CVSS 6.1 · Published 2026-02-26

Vendors: Google.

Executive brief

Angular is a popular development framework used to build web and mobile applications. A security flaw in its translation system could allow malicious code to be injected into an application if its translation files (used for different languages) are tampered with. If exploited, this could allow an attacker to steal user credentials, access sensitive data, or deface the website.

Technical details

A cross-site scripting (XSS) vulnerability exists in the Angular internationalization (i18n) pipeline due to improper sanitization of HTML within International Components for Unicode (ICU) messages. The vulnerability occurs during the 'merge' phase of the i18n workflow, where translated content is integrated back into the application. If an attacker compromises the translation source files (such as .xliff or .xtb files), they can inject malicious HTML/JavaScript that executes in the context of the application origin. Exploitation requires the application to use Angular i18n with ICU messages and lacks a restrictive Content Security Policy (CSP). The fix introduces an allowlist for HTML attributes in translated ICU content and blocks sensitive URI attributes.

Affected products

  • Google Angular < 21.2.0, < 21.1.6, < 20.3.17, < 19.2.19, <= 18.2.14

Timeline

  • 2026-02-20: other: Fix pull request submitted
  • 2026-02-24: patched: Fix merged into main branch
  • 2026-02-25: advisory: GitHub Security Advisory published
  • 2026-02-26: disclosed: CVE published to NVD

References