CVE-2026-11998: AngularJS SCE Bypass Enables XSS Attacks—Patch & Mitigation Guide

Technical summary

CVE-2026-11998 stems from incomplete URL matching logic in AngularJS's Strict Contextual Escaping implementation. SCE is designed to enforce a whitelist of safe contexts where dynamic values can be used (resource URLs, iframe documents, route templates, etc.) by validating values against regular expression patterns. The vulnerability arises when SCE's matching algorithm performs partial rather than complete URL validation against these patterns, enabling an attacker to craft a URL that bypasses the regex check while still being interpreted as a valid resource reference by the browser. This results in arbitrary JavaScript execution within the application's security context. The flaw affects all AngularJS versions from 1.2.0-rc.3 onward.

Business impact

Organizations relying on legacy AngularJS applications face a material risk of cross-site scripting (XSS) attacks that could compromise user sessions, steal sensitive data, or redirect users to credential-harvesting pages. Since AngularJS reached end-of-life before this CVE was published, no official patches will be released. Companies must either migrate away from AngularJS, implement compensating security controls (such as Content Security Policy), or accept elevated risk. The vulnerability's high CVSS score (7.6) reflects the combination of ease of exploitation and potential for serious impact.

Affected systems

This vulnerability affects all AngularJS applications running versions 1.2.0-rc.3 through the final release. End-of-life status means no patched versions exist from the AngularJS project itself. Any web application or content management system embedding AngularJS in that version range is potentially at risk if user-controlled data influences URL construction in security-sensitive contexts. Third-party frameworks or libraries built on AngularJS may also be affected if they do not provide their own mitigations.

Exploitability

The vulnerability is highly exploitable and requires only network access and user interaction. An attacker needs to craft a malicious URL that passes SCE validation due to the regex matching flaw, then trick a user into visiting it or embed it in a compromised third-party resource. No authentication, elevated privileges, or complex setup is required on the attacker's side. The bar for exploitation is low, though the attack does depend on a victim clicking a link or visiting a page—it cannot be remotely triggered without user action.

Remediation

Because AngularJS is end-of-life, the vendor will not release patches. Organizations should prioritize one of three approaches: (1) Migrate applications to a modern framework (React, Vue, Angular—the successor), which eliminates dependency on vulnerable AngularJS; (2) Implement strict Content Security Policy (CSP) headers to restrict script execution and resource loading, reducing the window for exploitation; (3) If migration is not immediately feasible, conduct a thorough security review to identify and eliminate user-controlled input in resource URL contexts, then apply defense-in-depth measures such as input validation, output encoding, and network-level controls.

Patch guidance

No official patches will be released for AngularJS. Vendors of applications or frameworks that embed AngularJS may provide updates; consult your software vendor's security advisories. If you maintain custom AngularJS applications, assess whether you can apply a local patch to SCE's URL matching logic—however, this approach carries maintenance risk and should only be done as a temporary measure while migration is planned. Verify the end-of-life status of any third-party AngularJS derivatives you use to determine if they have released mitigations.

Detection guidance

Monitor web application logs for unusual or malformed URLs being passed to resource-loading contexts, particularly in parameters that influence iframe src, script src, or route templates. Look for URL patterns that appear to bypass SCE validation (e.g., obfuscated or encoded URLs that resolve to javascript: or data: schemes). Implement CSP reporting to capture blocked resource violations that may indicate attack attempts. Security testing tools and dynamic analysis can help identify instances where user input reaches SCE-protected contexts without proper sanitization. Endpoint detection systems should flag attempts to execute unexpected inline scripts originating from a single web application session.

Why prioritize this

While this vulnerability carries a high CVSS score and is theoretically exploitable in any affected application, prioritization should account for end-of-life status and actual AngularJS usage in your environment. If your organization has already migrated away from AngularJS or uses only isolated internal applications, the practical risk may be lower. However, any customer-facing AngularJS application, legacy system handling sensitive data, or publicly-accessible web property running vulnerable versions should be treated as urgent, as exploitation is straightforward and attackers may target these applications knowing patches are unavailable.

Risk score, explained

The CVSS 3.1 score of 7.6 (HIGH) reflects: (1) Network-accessible attack vector with low complexity; (2) Requirement for user interaction but no authentication needed; (3) High confidentiality impact (attacker gains access to session data and resources); (4) Low integrity and availability impact (XSS can modify page content but complete system compromise is less likely). The score does not account for the mitigating factor of end-of-life status; however, for active applications still in use, the practical severity remains high because remediation must be organizational rather than vendor-driven.

Frequently asked questions