AIKIDO-2026-134896

TL;DR

DOMSanitizer's CSS normalization decodes escape sequences before checking url() and @import values against blocked external schemes, but it skips a backslash immediately followed by a newline, which browsers remove as a line continuation. Sanitized HTML, SVG, or inline style attributes with a URL split across that line continuation keep their external scheme hidden from the filter, so the sanitizer output still fetches the untrusted external resource in a browser. The fix normalizes line endings before decoding, checks the CSS through additional normalized views, and ends a string at a raw unescaped newline the way browsers do.