List view

Filling a DocumentFragment in the main document can have side effects

sanitizer-algorithmissue with the algorithmissue with the algorithm

Status: Open.

#363 In WICG/sanitizer-api;

· noamr opened on Nov 27, 2025

Update whatwg/html's editor checklist to check whether new elements and attributes need to be added to the allow lists

Status: Open.

#206 In WICG/sanitizer-api;

· ghost opened on Jan 16, 2024

Document threat models

Status: Open.

#287 In WICG/sanitizer-api;

· annevk opened on Apr 16, 2025

Upstreaming to HTML

Status: Open.

#291 In WICG/sanitizer-api;

· mozfreddyb opened on May 14, 2025

Include additional reasoning for all elements not allowed in the default config

Status: Open.

#354 In WICG/sanitizer-api;

· mozfreddyb opened on Nov 5, 2025

Create tests for interesting parser behavior and replaceWithChildrenElements

Status: Open.

#366 In WICG/sanitizer-api;

· zcorpan opened on Dec 10, 2025

Incorrect use of "replace all"

Status: Open.

#372 In WICG/sanitizer-api;

· jakearchibald opened on Feb 24, 2026

String-comparison against "href" + "xlink:href"

Status: Open.

#373 In WICG/sanitizer-api;

· otherdaniel opened on Mar 3, 2026

Should sanitizer be allowed to remove attributes that create a declarative shadow root?

Status: Open.

#388 In WICG/sanitizer-api;

· noamr opened on Mar 30, 2026

The is non-attribute allows custom elements to sneak in

Status: Open.

#387 In WICG/sanitizer-api;

· mozfreddyb opened on Mar 26, 2026