CVE-2026-54264: Angular Service Worker Cross-Origin Credential Leak Vulnerability

Technical summary

The vulnerability exists in the @angular/service-worker package's handling of cross-origin HTTP redirects. The Fetch specification requires that sensitive request headers (Authorization, Proxy-Authorization, and cookie-related headers) be stripped when a request crosses origin boundaries. The Angular Service Worker fails to implement this requirement, preserving the original request's headers through the redirect chain. This violates the Fetch redirect algorithm and allows credentials intended for the original origin to leak to the redirect destination. The flaw is triggered during asset fetching operations and requires user interaction to exploit—the victim must visit or be directed to a page served by an Angular application using the vulnerable Service Worker.

Business impact

Organizations relying on Angular applications with Service Workers face credential exposure risk. Compromised authorization tokens or session cookies could enable attackers to impersonate users, access protected resources, or escalate privileges within connected systems. The impact scales with the sensitivity of data the compromised credentials protect. For SaaS providers and applications handling financial or healthcare data, this creates both direct security exposure and potential regulatory compliance concerns. The requirement for user interaction (clicking a link or following a redirect) limits large-scale automated exploitation but makes targeted phishing and watering-hole attacks more feasible.

Affected systems

Angular applications using versions prior to 22.0.1 (latest), 21.2.17 (LTS), or 20.3.25 (extended LTS) with the @angular/service-worker package enabled are vulnerable. The Service Worker must be active in the application for the vulnerability to be exploitable. Applications not using Service Workers or running patched versions are unaffected. Organizations should audit their Angular deployments to identify which versions are in production and whether Service Worker functionality is enabled.

Exploitability

The attack requires both a vulnerable Angular application and user interaction—the victim must follow a link or be redirected to a malicious site while the Service Worker is active. Network access is unrestricted, and no special privileges are required on the attacker side. The Fetch redirect can be triggered through normal web navigation, email links, or compromised advertisements. However, the attacker cannot directly force the compromise; they must socially engineer or otherwise convince the user to interact with a crafted URL. The CVSS score of 6.1 reflects this user-interaction requirement combined with the scope change (cross-origin impact) and limited confidentiality/integrity consequences.

Remediation

Patch affected Angular installations immediately to versions 22.0.1, 21.2.17, or 20.3.25 depending on your current release line. Review your Angular dependency management to ensure automatic patching or a clear update schedule is in place. For applications unable to patch immediately, consider disabling Service Worker functionality if business requirements permit, though this removes offline-capability benefits. Additionally, implement Content Security Policy (CSP) headers and other defense-in-depth measures to restrict redirect destinations and limit the impact of credential exposure.

Patch guidance

Update your Angular package using npm or yarn: npm update @angular/[email protected] (or the appropriate LTS version for your branch). Verify the update in your package-lock.json or yarn.lock. Test thoroughly in a staging environment before production deployment, as Service Worker changes can affect offline behavior and asset caching. Angular provides release notes for each version; review them to confirm no breaking changes affect your application. If you are on the 21.x or 20.x LTS branches, use 21.2.17 or 20.3.25 respectively rather than jumping to 22.0.1 unless you have capacity for a major version upgrade.

Detection guidance

Monitor HTTP requests from your Service Worker for unexplained cross-origin redirects, particularly those involving credential-bearing headers. Use browser DevTools Network tab to inspect Service Worker requests; look for Authorization or Cookie headers being sent to external domains. On the server side, log and alert on unexpected authentication token usage from unfamiliar origins or IP addresses. Implement request signing or token binding to prevent credential reuse from different network contexts. For organizations using browser security monitoring, watch for Service Worker-initiated requests that traverse multiple origins in a single session.

Why prioritize this

While the CVSS score is MEDIUM, the vulnerability's reliance on user interaction and credential exposure vector makes it a pragmatic priority for patching. Service Workers are increasingly common in modern Angular applications, particularly those targeting mobile users or requiring offline functionality. The attack surface—any user visiting a vulnerable application—is broad. Combined with the low patch friction (standard npm update), most organizations should prioritize this within a two-week patching window. However, it does not warrant emergency response protocols reserved for actively exploited vulnerabilities or those affecting air-gapped infrastructure.

Risk score, explained

The CVSS 3.1 score of 6.1 (MEDIUM) reflects: unrestricted network access (AV:N), low attack complexity (AC:L), no privilege requirement (PR:N), user interaction needed (UI:R), scope change due to cross-origin nature (S:C), and limited confidentiality/integrity impact (C:L/I:L) with no availability impact (A:N). The 'scope change' elevates severity from what might otherwise be a lower score, recognizing that the vulnerability affects security boundaries between origins. The user-interaction requirement prevents this from being HIGH; without a user following a crafted link, the vulnerability cannot be exploited. The limited confidentiality impact (header leakage rather than full session compromise) also constrains the score.

Frequently asked questions