angular · MeAkib · Sep 30, 2026
diff --git a/adev/src/content/reference/errors/NG0904.md b/adev/src/content/reference/errors/NG0904.md
@@ -0,0 +1,65 @@
+# Unsafe value used in a resource URL context
+
+Angular throws this error, with the message `unsafe value used in a resource URL context`, when a template or host binding sets an attribute that loads an external resource — like `<iframe src>` or `<link href>` — to a value that hasn't been explicitly marked as trusted.
+
+Resource URLs are treated differently from regular URLs. Angular can sanitize a plain URL, but it can't make an arbitrary resource URL safe because these attributes cause the browser to fetch and execute external content. So Angular rejects untrusted values rather than trying to sanitize them.
+
+The attributes that trigger this check are:
+
+| Element    | Attribute(s)       |
+| ---------- | ------------------ |
+| `<base>`   | `href`             |
+| `<embed>`  | `src`              |
+| `<frame>`  | `src`              |
+| `<iframe>` | `src`              |
+| `<link>`   | `href`             |
+| `<object>` | `codebase`, `data` |
+
+## Debugging the error
+
+The error is thrown when any plain string is bound to one of the attributes above, even a static-looking URL:
+
+```angular-ts
+@Component({
+  selector: 'app-root',
+  template: `<iframe [src]="url"></iframe>`,
+})
+export class App {
+  url = 'https://example.com/embed';
+}
+```
+
+Passing the value through `DomSanitizer.sanitize()` with `SecurityContext.URL` does not help. `sanitize()` returns a plain string, and a plain string is never accepted in a resource URL context:
+
+```angular-ts
+@Component({
+  selector: 'app-root',
+  template: `<iframe [src]="sanitized"></iframe>`,
+})
+export class App {
+  private readonly sanitizer = inject(DomSanitizer);
+  sanitized = this.sanitizer.sanitize(SecurityContext.URL, 'https://example.com/embed'); // still throws NG0904
+}
+```
+
+Calling `sanitize()` with `SecurityContext.RESOURCE_URL` instead throws too, but with [NG05201](errors/NG05201), because `sanitize()` cannot make an arbitrary string safe in a resource URL context.
+
+If the URL comes from a trusted, controlled source, mark it safe using `DomSanitizer.bypassSecurityTrustResourceUrl`:
+
+```angular-ts
+import {DomSanitizer, SafeResourceUrl} from '@angular/platform-browser';
+
+@Component({
+  selector: 'app-root',
+  template: `<iframe [src]="safeUrl"></iframe>`,
+})
+export class App {
+  safeUrl: SafeResourceUrl = inject(DomSanitizer).bypassSecurityTrustResourceUrl(
+    'https://example.com/embed',
+  );
+}
+```
+
+CRITICAL: `bypassSecurityTrustResourceUrl` is an escape hatch, not a sanitizer. Never pass user-supplied URLs through it — that would allow an attacker to load arbitrary content, including malicious scripts. Only use it when the value is fully under your control.
+
+For more information, see the [Security guide](best-practices/security#trusting-safe-values).
diff --git a/adev/src/content/reference/errors/overview.md b/adev/src/content/reference/errors/overview.md
@@ -30,6 +30,7 @@
 | `NG0602`  | [Disallowed function call inside reactive context](errors/NG0602)                    |
 | `NG0750`  | [@defer dependencies failed to load](errors/NG0750)                                  |
 | `NG0751`  | [@defer behavior when HMR is enabled](errors/NG0751)                                 |
+| `NG0904`  | [Unsafe value used in a resource URL context](errors/NG0904)                         |
 | `NG0910`  | [Unsafe bindings on an iframe element](errors/NG0910)                                |
 | `NG0912`  | [Component ID generation collision](errors/NG0912)                                   |
 | `NG0913`  | [Runtime Performance Warnings](errors/NG0913)                                        |

diff --git a/goldens/public-api/core/errors.api.md b/goldens/public-api/core/errors.api.md
@@ -198,7 +198,7 @@ export const enum RuntimeErrorCode {
     // (undocumented)
     UNSAFE_ATTRIBUTE_BINDING = -910,
     // (undocumented)
-    UNSAFE_VALUE_IN_RESOURCE_URL = 904,
+    UNSAFE_VALUE_IN_RESOURCE_URL = -904,
     // (undocumented)
     UNSAFE_VALUE_IN_SCRIPT = 905,
     // (undocumented)

diff --git a/packages/core/src/errors.ts b/packages/core/src/errors.ts
@@ -118,7 +118,7 @@ export const enum RuntimeErrorCode {
   NO_SUPPORTING_DIFFER_FACTORY = 901,
   VIEW_ALREADY_ATTACHED = 902,
   INVALID_INHERITANCE = 903,
-  UNSAFE_VALUE_IN_RESOURCE_URL = 904,
+  UNSAFE_VALUE_IN_RESOURCE_URL = -904,
   UNSAFE_VALUE_IN_SCRIPT = 905,
   MISSING_GENERATED_DEF = 906,
   TYPE_IS_NOT_STANDALONE = 907,