Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

Angular bug bounty programs

angular.dev Updated Part of Google

Angular runs one public program: a Sorona bug bounty paying up to $7,500.

Top reward
$7,500
Sorona
Programs
1
1 pays cash
Targets in scope
13
2 types
Last change
None yet
Tracked since Nov 2026

Where to report

The one public program Angular runs.

  • Angular

    Sorona · Bug bounty

    Open

    Top reward

    $7,500
    Safe harbor
    Partial

Amounts are the top reward per severity in the currency each program pays. First response is the platform's measured average when it publishes one, else what the policy promises.

What is in scope

13 targets. 8 excluded.

  • https://angular.dev

    Web

  • @angular/common/http: interceptors, JSONP, and the XSRF token handling that guards outbound authenticated requests

    Products and areas

  • @angular/router: route matching, guards, resolvers, parameter and fragment handling, and lazy-loaded route boundaries

    Products and areas

  • Angular is a Google-owned GitHub organisation, which the program's own scope sentence covers, and the tier file names four of its repositories at OT0: angular/angular, angular/angular-cli, angular/components and angular/dev-infra. A product vulnerability anywhere in those four is priced at $500 to $7,500

    Products and areas

  • Angular Material and the CDK in angular/components: overlays, dialogs, menus, tables and every component that renders content the application did not author

    Products and areas

  • angular/dev-infra, the shared build, release and CI tooling the other three repositories run through, along with npm publishing and release signing in the supply-chain category

    Products and areas

  • DomSanitizer, the bypassSecurityTrust* family, and the HTML, URL, style and resource-URL sanitisers, which the program names as a reward category of its own: "Failures in the sanitizer functions (e.g. HTML sanitizers)"

    Products and areas

  • Forms in both the reactive and template-driven flavours, and the validators applications rely on to constrain user input

    Products and areas

  • Server-side rendering and hydration in @angular/platform-server, including the SSR state transfer that carries server-side data into the client bundle

    Products and areas

  • Template syntax and expression evaluation, including property, attribute, class and event bindings, and the control-flow blocks the compiler expands

    Products and areas

  • The core framework: change detection, the dependency injection container, and the template compiler together with the rendering code it emits

    Products and areas

  • The ng CLI, @angular-devkit/build-angular, schematics, and the dev server and build pipeline in angular-cli

    Products and areas

  • zone.js, the async scheduling layer the framework's change detection is built on

    Products and areas

No target matches. Try part of a host name, such as the company name.

Out of scope 8

Don't test these. A program can exclude a host another program covers; the program you report to decides.

  • AngularJS 1.x, which is end-of-life and does not appear in the tier file at any band

  • Awards to researchers on sanctions lists, in territories subject to sanctions, or located in Russia or Belarus, which Google states it will not issue

  • Bugs in applications built with Angular rather than defects in the framework itself

  • Developer-machine-only issues in the CLI dev server where you cannot describe a realistic attack scenario

  • Insecure application configuration chosen by a downstream integrator

  • Reports filed by anyone other than the researcher: Google requires the submission under your own identity through bughunters.google.com, and treats routing around the designated channel as grounds to reject

  • Repositories the tier file does not name, and releases that are not current: the program covers the latest versions of the listed repositories, and any other repository in the same organisation counts only where the file names it. What the file omits sits at OT2 or OT3, where product vulnerabilities earn no monetary reward

  • Third-party Angular component libraries, which are not Google-maintained and are not covered by the tier file

Recent changes

Reward and scope changes across every Angular program, newest first.

No changes recorded yet. New targets and reward moves show up here and in the RSS feed.

Recent CVEs

Published vulnerabilities in Angular products, from the NVD.

Search NVD
  • CVE-2026-88057 Medium

    Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.28, 21.2.20, and 22.1.0, Angular's compiler and runtime in @angular/core and @angular/compiler could omit or select an incorrect sanitizer for security-sensitive directive host bindings because SecurityContext was derived from the declaring directive or

  • CVE-2026-88058 High

    Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.30, 21.2.22, and 22.1.4, Angular server-side rendering (SSR) in @angular/platform-server serializes ProcessingInstruction DOM nodes inside fallback raw-content elements without escaping matching ancestor closing tags. ProcessingInstruction data escaped g

  • CVE-2026-88059 Medium

    Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.28, 21.2.20, and 22.1.1, Angular's @angular/common HttpTransferCache can cache an authenticated response when Server-Side Rendering (SSR) and hydration use a hierarchical HttpClient configured with withRequestsMadeViaParent. The child TransferCache evalu

  • CVE-2026-88060 High

    Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.30, 21.2.22, and 22.1.4, Angular server-side rendering (SSR) in @angular/platform-server serializes untrusted input inside template content nested in fallback raw-content elements such as noscript, iframe, noembed, and noframes. The Domino serializer's f

  • CVE-2026-88056 High

    Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.30, 21.2.22, and 22.1.4, Angular Server-Side Rendering in @angular/platform-server processes user-controlled resource or request URLs through HttpClient after application code validates them with WHATWG URL parsing. The resolveUrl and parseUrl utilities

  • CVE-2026-69149 High

    Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.27, 21.2.19, and 22.0.7, a Cross-Site Scripting (XSS) vulnerability exists in @angular/platform-server's DOM emulation dependency (domino) when serializing the content of fallback raw-content elements (<iframe>, <noembed>, <noframes>, and <noscript>). Th

  • CVE-2026-69151 High

    Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.27, 21.2.19, and 22.0.1, the Angular compiler i18n pipeline permits i18n-onerror and other i18n-on event-handler attributes, allowing a lower-trust translation file to replace a static handler with executable JavaScript. This issue is fixed in versions 2

  • CVE-2026-68945 High

    Angular is a development platform for building mobile and desktop web applications using TypeScript/JavaScript and other languages. Prior to 20.3.27, 21.2.19, and 22.0.2, HttpTransferCache comma-joins repeated request parameters, allowing semantically distinct HttpClient requests to use the same transfer-cache key and reuse a wrong backend response. This issue is fixed in versions 20.3.27, 21.2.19

About this page

This page gathers every public program listed under angular.dev: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test.

Something wrong or missing? Report a correction.