AIKIDO-2026-514793

TL;DR

DOMPurify removes disallowed attributes by calling removeAttributeNode on the element, but a form descendant named removeAttributeNode or getAttributeNode shadows that method through [LegacyOverrideBuiltIns], so the call throws. The code falls back to name based removeAttribute, which ASCII-lowercases its lookup key in an HTML document and skips a case preserved event handler attribute such as ONANIMATIONSTART that entered through an XML/XHTML parse. The rejected handler survives sanitization and runs in the browser. The fix removes the attribute through a cached Element.prototype.removeAttributeNode and flags forms that clobber removeAttributeNode/getAttributeNode so they are removed.