Angular’s server‑side rendering hydration process serializes application state into a <script> tag identified by the id ‘ng-state’. During client bootstrap, Angular retrieves this element by ID, parses its content as JSON, and restores the state. The lookup uses only the ID selector, making it susceptible to DOM clobbering. If an attacker injects untrusted content that places an element with id="ng-state" before the legitimate script tag, the browser will return the attacker‑crafted element. Angular will then parse the attacker’s content, which can contain malicious JavaScript or malformed data, potentially leading to arbitrary client‑side code execution, state corruption, or session hijacking. The flaw aligns with CWE‑79, CWE‑807, and CWE‑471.

All Angular applications that use provideClientHydration() for server‑side rendering and are built with versions prior to 22.0.1, 21.2.17, or 20.3.25 are vulnerable. Projects that inject user‑controlled or CMS data directly into the page and bind that data to element IDs are exposed if such content can precede the hydration script.

The CVSS score of 8.6 indicates high severity. An EPSS score of less than 1% signifies a very low but non‑zero probability of exploitation in the current threat landscape. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires an attacker who can supply or influence content that assigns id='ng-state' before the hydration script, such as through a content management system or by controlling a user input that is rendered with a binding to id. Successful exploitation results in arbitrary client‑side code execution or state corruption when the page loads.