Summary

The SVG animation elements (<animate>, <set>, <animateMotion>, <animateTransform>) have their attributeName binding correctly blocked via SecurityContext.ATTRIBUTE_NO_BINDING (see b/463880509#comment7). However, the value attributes (to, from, values, by) — which carry the actual data written to the animated attribute — have SecurityContext.NONE. No URL sanitization is applied to them.

When a developer uses a static attributeName="href" and binds an animation value to user-controlled data (e.g. [attr.to]="url"), an attacker can inject javascript: URIs that execute when the user clicks the animated SVG link.

The Bug

@Component({
  template: `
    <svg>
      <a>
        <set attributeName="href" [attr.to]="linkTarget" />
        <text y="20">Click me</text>
      </a>
    </svg>
  `
})
export class ExampleComponent {
  linkTarget = 'javascript:alert(document.cookie)';
}

Angular compiles [attr.to] with SecurityContext.NONE because set|to is not in the security schema:

DomElementSchemaRegistry.securityContext('set', 'to', true)
  → SECURITY_SCHEMA['set|to']   → NOT FOUND
  → SECURITY_SCHEMA['*|to']     → NOT FOUND
  → Returns: SecurityContext.NONE → No sanitization applied

The javascript: URI passes through unsanitized. The SVG animation engine writes it to the parent <a> element's href.animVal. Clicking the link executes JavaScript.

Compare with a standard <a> element, which is correctly sanitized:

Browser Verification

Confirmed in Chromium 136. Clicking an SVG <a> element whose href was set via <set attributeName="href" to="javascript:alert(document.domain)"> triggered JavaScript execution, displaying "localhost".

Both <set> and <animate> vectors execute in Chrome, Firefox, and Safari.

The Fix

This commit adds all SVG animation value attributes to the SecurityContext.URL section of dom_security_schema.ts:

'animate|to', 'animate|from', 'animate|values', 'animate|by',
'set|to',
'animateMotion|to', 'animateMotion|from', 'animateMotion|values', 'animateMotion|by',
'animateTransform|to', 'animateTransform|from', 'animateTransform|values', 'animateTransform|by',

The URL sanitizer only blocks dangerous schemes (javascript:, vbscript:, data:) — it will not break legitimate animation values such as colors, numbers, or transform strings.

References

• Internal bug reference in Angular source: http://b/463880509#comment7
• SVG <set> spec: https://developer.mozilla.org/en-US/docs/Web/SVG/Element/set
• SVG <animate> spec: https://developer.mozilla.org/en-US/docs/Web/SVG/Element/animate
• Related CVEs: CVE-2025-66412, CVE-2026-22610, CVE-2026-27970, CVE-2026-32635