The vulnerability stems from AngularJS's failure to apply image source sanitization to the [srcset] attribute in <source> elements when set via ngAttrSrcset or interpolation. The $compile service (responsible for DOM manipulation) and interpolation logic (handling dynamic values) are implicated because they process these attributes without invoking the sanitization routines that normally enforce imgSrcSanitizationTrustedUrlList restrictions. This matches the CWE-791 pattern of incomplete filtering, as AngularJS's security controls are partially implemented for this attribute. Confidence is high for the $compile service's role given explicit documentation of ngAttrSrcset bypasses, and medium for interpolation logic due to indirect evidence in reproduction examples.