AIKIDO-2026-313132

TL;DR

Braintree Drop-in renders payment method details, error messages, and payment option labels by assigning strings to innerHTML and relies on a sanitizeHtml helper that only escapes < and >. Untrusted values such as a vaulted PayPal account email or payment source strings are inserted into the DOM without complete escaping, so embedded markup can execute as script in the merchant checkout page. Before the fix this allows cross-site scripting when such values reach the affected rendering paths. The fix replaces the vulnerable innerHTML writes with textContent, tightens sanitizeHtml to also escape &, ", and ', and sanitizes the PayPal email and payment option values before template insertion.