diff --git a/packages/compiler/src/schema/trusted_types_sinks.ts b/packages/compiler/src/schema/trusted_types_sinks.ts index 0d69ccee47f9..b8a8449665a0 100644 --- a/packages/compiler/src/schema/trusted_types_sinks.ts +++ b/packages/compiler/src/schema/trusted_types_sinks.ts @@ -28,6 +28,13 @@ const TRUSTED_TYPES_SINKS = new Set([ 'iframe|src', 'object|codebase', 'object|data', + + // RESOURCE_URL sinks missing from original Trusted Types integration. + // These are classified as RESOURCE_URL in dom_security_schema.ts and must + // be blocked in i18n attribute bindings (same as embed|src, iframe|src). + 'base|href', + 'frame|src', + 'link|href', ]); /**