Cross-site scripting via miscomputed host-binding sanitizer

Cross-site scripting in affected Angular @angular/core and @angular/compiler releases allows remote attackers to execute JavaScript in browsers. The compiler derives SecurityContext from the declaring selector instead of the concrete host element, so affected directive host bindings write attacker-controlled URL values to DOM attributes without the correct sanitizer. Exploitation requires an application to place attacker-controlled data in a security-sensitive host binding reached through composition, inheritance, dynamic creation, namespaces, or a tag-neutral selector; the consequence is script execution in a viewing user's browser context.