@angular/common: XSRF Token Leakage via URL Parsing Discrepancy in Angular HTTP Client (Incomplete fix for CVE-2025-66035) (CVE-2026-111753)

The vulnerability arises from an incomplete fix for CVE-2025-66035 in Angular's @angular/common HttpClient. The XSRF interceptor used a regular expression to detect absolute URLs and skip attaching the XSRF token header. However, the regex did not account for URL normalization performed by the browser's WHATWG URL parser, which treats backslashes as forward slashes and strips control characters. This mismatch causes certain crafted URLs to bypass the regex check, leading the interceptor to treat them as same-origin and attach the XSRF token header. When the browser resolves these URLs, they point to attacker-controlled cross-origin domains, leaking the token. The vulnerability affects versions >=20.0.0 <20.3.34, >=21.0.0 <21.0.3, and <=19.2.25. The fix replaces the regex with a robust origin comparison using new URL(req.url, locationOrigin).

The vulnerability allows an attacker to obtain a victim user's valid XSRF token by causing the Angular application to send requests with the XSRF token header to attacker-controlled cross-origin URLs that bypass the interceptor's regex check. If the attacker's server permits the request and custom header via CORS, the attacker can capture the token and perform Cross-Site Request Forgery (CSRF) attacks against the victim's session. This bypasses Angular's built-in XSRF protection on affected versions.

A patch is available and should be applied. The issue is fixed in Angular versions 21.0.3, all 22.x releases, and 20.3.34 by replacing the regex with a proper origin comparison using the standard URL constructor. If immediate upgrading is not possible, validate and normalize outgoing request URLs using new URL(url, window.location.origin) and verify that parsedUrl.origin === window.location.origin before passing dynamic URLs to mutating HttpClient requests. Avoid passing untrusted or user-controlled URLs to HttpClient mutating methods.