Executive brief
Angular, a popular web development framework, contains a vulnerability in how it handles data during the 'hydration' process (the transition from a server-rendered page to an interactive app). An attacker can trick the application into using malicious data instead of legitimate server responses by manipulating page elements. This could allow an attacker to steal user information, escalate their privileges within the app, or perform unauthorized actions on behalf of a user.
Technical details
A DOM Clobbering vulnerability exists in Angular's hydration logic when using provideClientHydration(). During client-side bootstrap, Angular retrieves its serialized state from the DOM using a predictable ID (defaulting to 'ng-state'). If an application renders untrusted user input or CMS content that allows setting element IDs (e.g., <a id='ng-state'>) before the legitimate state script tag, the browser's document.getElementById call returns the attacker-controlled element. This allows an attacker to inject a malicious JSON payload into the TransferState cache. By poisoning the HTTP Transfer Cache, an attacker can spoof API responses, leading to DOM-based XSS, privilege escalation, or UI hijacking. The fix involves hardening the restoration process to ensure only legitimate script elements are processed.
Affected products
- Google Angular >= 22.0.0-next.0 < 22.0.1, >= 21.0.0-next.0 < 21.2.17, >= 20.0.0-next.0 < 20.3.25, <= 19.2.25
Timeline
- 2026-06-01: other: Fix pull request submitted
- 2026-06-10: advisory: GitHub Security Advisory published
- 2026-06-22: disclosed: CVE published to NVD