angular/angular · error · RuntimeError

SANITIZATION_UNEXPECTED_CTX

SANITIZATION_UNEXPECTED_CTX

Error message

Unexpected SecurityContext ${ctx} (see ${XSS_SECURITY_URL})

What it means

Error "Unexpected SecurityContext ${ctx} (see ${XSS_SECURITY_URL})" thrown in angular/angular.

Source

Thrown at packages/platform-browser/src/security/dom_sanitization_service.ts:208

          (typeof ngDevMode === 'undefined' || ngDevMode) &&
            'unsafe value used in a script context',
        );
      case SecurityContext.URL:
        if (allowSanitizationBypassOrThrow(value, BypassType.Url)) {
          return unwrapSafeValue(value);
        }
        return _sanitizeUrl(String(value));
      case SecurityContext.RESOURCE_URL:
        if (allowSanitizationBypassOrThrow(value, BypassType.ResourceUrl)) {
          return unwrapSafeValue(value);
        }
        throw new RuntimeError(
          RuntimeErrorCode.SANITIZATION_UNSAFE_RESOURCE_URL,
          (typeof ngDevMode === 'undefined' || ngDevMode) &&
            `unsafe value used in a resource URL context (see ${XSS_SECURITY_URL})`,
        );
      default:
        throw new RuntimeError(
          RuntimeErrorCode.SANITIZATION_UNEXPECTED_CTX,
          (typeof ngDevMode === 'undefined' || ngDevMode) &&
            `Unexpected SecurityContext ${ctx} (see ${XSS_SECURITY_URL})`,
        );
    }
  }

  override bypassSecurityTrustHtml(value: string): SafeHtml {
    return bypassSanitizationTrustHtml(value);
  }
  override bypassSecurityTrustStyle(value: string): SafeStyle {
    return bypassSanitizationTrustStyle(value);
  }
  override bypassSecurityTrustScript(value: string): SafeScript {
    return bypassSanitizationTrustScript(value);
  }
  override bypassSecurityTrustUrl(value: string): SafeUrl {
    return bypassSanitizationTrustUrl(value);

View on GitHub (pinned to 51cb07e980)

Solutions

1. A sanitizer was called with an unsupported SecurityContext; this is framework-internal — update Angular or avoid calling the sanitizer with custom contexts.

When it happens

Trigger: Thrown at packages/platform-browser/src/security/dom_sanitization_service.ts:208 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of angular/angular@51cb07e980 (2026-08-22). Data as JSON: /api/errors/1722fa428ada868e. Report an issue: GitHub.