Technology · Google
Google Angular vulnerabilities
Updated . Rebuilt every hour.
Junglewise Threat Intelligence has tracked 17 vulnerabilities in Google Angular: 0 in the last 7 days and 2 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-101896, was published on 14 October 2026. 1 vulnerability in the last four weeks, up from none in the four before.
- Last 7 days
- 0
- Last 90 days
- 2
- Critical, all time
- 0
- Exploited in the wild
- 0
About Google Angular
JavaScript framework for building user interfaces with component-based architecture.
Latest Google Angular vulnerabilities
- CVE-2026-101896: Angular Server-Side Rendering denial of service via numeric URL matrix parametershighCVSS 4EPSS 0.7%
- CVE-2026-88058: Angular platform-server XSS via ProcessingInstruction DOM serializationhighCVSS 4EPSS 0.9%
- CVE-2026-69149: Angular SSR XSS in fallback raw-content elementshighCVSS 4EPSS 0.4%
- CVE-2026-50556: Angular XSS in platform-server noscript serializationhighCVSS 4EPSS 0.4%
- CVE-2026-50555: Google Angular XSS in @angular/platform-server via domino serializationhighCVSS 3.1EPSS 0.3%
- CVE-2026-50171: Google Angular Denial of Service in @angular/common number formattinghighCVSS 3.1EPSS 0.3%
- CVE-2026-50170: Google Angular information disclosure in @angular/common HttpTransferCachehighCVSS 3.1EPSS 0.4%
- CVE-2026-50168: Google Angular SSRF allowlist bypass in platform-serverhighCVSS 3.1EPSS 0.2%
- CVE-2026-54267: Google Angular DOM Clobbering in Client HydrationhighCVSS 3.1EPSS 0.3%
- CVE-2026-54264: Google Angular sensitive header leakage in Service WorkerhighCVSS 3.1EPSS 0.4%
- CVE-2026-52725: Angular XSS via dynamic component mounting on script elementsmediumCVSS 3.1EPSS 0.4%
- CVE-2026-50557: Google Angular XSS bypass via namespaced elements and attributesmediumCVSS 3.1EPSS 0.3%
- CVE-2026-46417: Angular @angular/platform-server SSRF via Hostname HijackinghighCVSS 3.1EPSS 0.4%
- CVE-2026-32635: Angular XSS in i18n attribute bindingslowCVSS 3.1EPSS 0.5%
- CVE-2026-27970: Google Angular XSS in internationalization ICU messagesmediumCVSS 6.1EPSS 0.4%
- CVE-2025-59052: Angular Server-Side Rendering race condition in platform injectormediumCVSS 4EPSS 0.3%
- CVE-2021-4231: Angular XSS via HTML comment handlinglowCVSS 3.1EPSS 1.2%
Most severe Google Angular vulnerabilities
Exploited in the wild first, then by severity and CVSS score.
- CVE-2026-88058: Angular platform-server XSS via ProcessingInstruction DOM serializationhighCVSS 4EPSS 0.9%
- CVE-2026-101896: Angular Server-Side Rendering denial of service via numeric URL matrix parametershighCVSS 4EPSS 0.7%
- CVE-2026-50556: Angular XSS in platform-server noscript serializationhighCVSS 4EPSS 0.4%
- CVE-2026-69149: Angular SSR XSS in fallback raw-content elementshighCVSS 4EPSS 0.4%
- CVE-2026-50170: Google Angular information disclosure in @angular/common HttpTransferCachehighCVSS 3.1EPSS 0.4%
- CVE-2026-54264: Google Angular sensitive header leakage in Service WorkerhighCVSS 3.1EPSS 0.4%
- CVE-2026-46417: Angular @angular/platform-server SSRF via Hostname HijackinghighCVSS 3.1EPSS 0.4%
- CVE-2026-54267: Google Angular DOM Clobbering in Client HydrationhighCVSS 3.1EPSS 0.3%
- CVE-2026-50555: Google Angular XSS in @angular/platform-server via domino serializationhighCVSS 3.1EPSS 0.3%
- CVE-2026-50171: Google Angular Denial of Service in @angular/common number formattinghighCVSS 3.1EPSS 0.3%
Vulnerabilities per week
1 vulnerability in the last four weeks, up from none in the four before. The last 13 weeks, by the week each vulnerability was published.
| Week of | Bar | Vulns | Critical |
|---|---|---|---|
| 17 Aug 2026 | 0 | 0 | |
| 24 Aug 2026 | 0 | 0 | |
| 31 Aug 2026 | 0 | 0 | |
| 7 Sep 2026 | 1 | 0 | |
| 14 Sep 2026 | 0 | 0 | |
| 21 Sep 2026 | 0 | 0 | |
| 28 Sep 2026 | 0 | 0 | |
| 5 Oct 2026 | 0 | 0 | |
| 12 Oct 2026 | 1 | 0 | |
| 19 Oct 2026 | 0 | 0 | |
| 26 Oct 2026 | 0 | 0 | |
| 2 Nov 2026 | 0 | 0 | |
| 9 Nov 2026 | 0 | 0 |
Embed a badge
A live badge for a README, a status page or an internal wiki: how many Google Angular vulnerabilities were published in the last 7 days and how many of them are critical, refreshed hourly.
[](https://junglewise.ai/threats/technologies/google-angular)<a href="https://junglewise.ai/threats/technologies/google-angular"><img src="https://junglewise.ai/threats/technologies/google-angular/badge.svg" alt="Google Angular vulnerabilities" /></a>How this is built
Junglewise Threat Intelligence collects vulnerabilities from NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories, and matches each one to the technologies and vendors it affects. Dates are the date a vulnerability was published, in UTC.
The pages are rebuilt from the database every hour. Frozen weekly and monthly reports never change once published, so they can be cited.
Use this data
The same data is at https://junglewise.ai/threats/technologies/google-angular.json, and this page as text at https://junglewise.ai/threats/technologies/google-angular.md, for scripts and language models. It is free to reuse under CC BY 4.0 with a link back to this page.
Cite as: Junglewise Threat Intelligence, "Google Angular vulnerabilities", https://junglewise.ai/threats/technologies/google-angular, 12 November 2026.