angular
diff --git a/‎packages/compiler/src/render3/view/i18n/meta.ts‎
Lines changed: 1 addition & 1 deletion b/‎packages/compiler/src/render3/view/i18n/meta.ts‎
Lines changed: 1 addition & 1 deletion
diff --git a/‎packages/core/test/linker/security_integration_spec.ts‎
Lines changed: 9 additions & 0 deletions b/‎packages/core/test/linker/security_integration_spec.ts‎
Lines changed: 9 additions & 0 deletions
@@ -208,7 +208,7 @@ export class I18nMetaVisitor implements html.Visitor {
             isTrustedType = isTrustedTypesSink(node.name, name);
           }
 
-          if (isTrustedType) {
+          if (isTrustedType || name.toLowerCase().startsWith('on')) {
             this._reportError(
               attr,
               `Translating attribute '${name}' is disallowed for security reasons.`,
 
@@ -368,6 +368,15 @@ describe('security integration tests', function () {
       expect(link.getAttribute('href')).toEqual('unsafe:javascript:alert(1)');
     });
 
+    it('should throw error on translated event attributes', () => {
+      const template = `<img src="/missing-image.png" onerror="void 0" i18n-onerror>`;
+      TestBed.overrideComponent(SecuredComponent, {set: {template}});
+
+      expect(() => TestBed.createComponent(SecuredComponent)).toThrowError(
+        /Translating attribute 'onerror' is disallowed for security reasons./,
+      );
+    });
+
     it('should throw error on security-sensitive attributes with constant values', () => {
       const template = `<iframe srcdoc="foo" i18n-srcdoc></iframe>`;
       TestBed.overrideComponent(SecuredComponent, {set: {template}});
Original file line number	Diff line number	Diff line change
`@@ -208,7 +208,7 @@ export class I18nMetaVisitor implements html.Visitor {`
`208`	`208`	`isTrustedType = isTrustedTypesSink(node.name, name);`
`209`	`209`	`}`
`210`	`210`
`211`		`- if (isTrustedType) {`
	`211`	`+ if (isTrustedType \|\| name.toLowerCase().startsWith('on')) {`
`212`	`212`	`this._reportError(`
`213`	`213`	`attr,`
`214`	`214`	`Translating attribute '${name}' is disallowed for security reasons.`,