Angular automatically sanitizes untrusted values bound to security-sensitive DOM sinks to prevent XSS. Prior to the fix, the Angular compiler determined the SecurityContext for directive host bindings based on the declaring directive or component selector at compile time, not the concrete host element. When directives with security-sensitive host bindings were applied to different concrete host elements (e.g., via hostDirectives composition, class inheritance, dynamic component instantiation, SVG/MathML elements, or tag-neutral selectors), the compiler failed to associate the correct sanitizer or security context. This allowed untrusted inputs bound via host bindings to be written to DOM attributes without sanitization, enabling arbitrary JavaScript execution in the user's browser. The vulnerability is tracked as CVE-2026-88057 and has been patched in Angular versions 22.1.0, 21.2.20, and 20.3.28.

An attacker who can control values bound to affected directive host bindings can execute arbitrary JavaScript in the context of the user's browser, resulting in Cross-Site Scripting (XSS). This compromises user security by potentially stealing data, hijacking sessions, or performing actions on behalf of the user.

A fix is available in Angular versions 22.1.0, 21.2.20, and 20.3.28; upgrading to these versions or later is recommended. As a workaround, explicitly sanitize any user-controlled values assigned to directive host bindings using DomSanitizer.sanitize(SecurityContext.URL, ...) before assignment, or restrict inputs to validated safe URL schemes such as http:// and https://.