Angular Alert: Protocol-Relative URLs Leak XSRF Tokens (CVE-2025-66035)

The Angular team has issued a high-severity security advisory regarding a logic flaw in the framework’s HTTP Client, tracked as CVE-2025-66035. This vulnerability allows attackers to exploit protocol-relative URLs to steal users' XSRF tokens, undermining Angular's built-in CSRF protections. If an application makes a request to a URL starting with //, Angular mistakenly treats it as a same-origin request, attaching the user's XSRF token. To mitigate this risk, developers are advised to upgrade to patched versions (v21.0.1, v20.3.14, v19.2.16) and avoid using protocol-relative URLs in HttpClient requests.