This is a guided tour of representative vulnerability classes, not a claim to contain every vulnerability Angular could ever have. For each one I want to be specific about three things: what the mechanism actually is, what has to be true in your app for it to bite you, and what you do about it. Every version number and API name below was checked against the installed type definitions of @angular/core@22.1.4, @angular/common@22.1.4, @angular/platform-browser@22.1.4 and @angular/build@22.1.6, or against the primary advisory. The official advisory list was rechecked on 16 September 2026. Where I’m reading someone else’s incident report rather than code, I’ll say so.
