CVE-2026-65904 describes an improper check for unusual or exceptional conditions in DOMPurify through version 3.3.3. When sanitizing DOM elements passed in IN_PLACE mode that originate from a different window or realm, a cross-realm instanceof check in the private _isNode() function returns false. This causes DOMPurify to stringify the element, silently reset IN_PLACE to false, and return the unsanitized element unchanged, leaving any embedded XSS payloads intact. The vendor considers this scenario an edge case outside the threat model and has not planned a patch.

The vulnerability allows DOM elements from foreign realms to bypass sanitization in IN_PLACE mode, potentially enabling cross-site scripting (XSS) attacks if such elements contain malicious payloads. However, the impact is limited by the edge-case nature of the scenario and the vendor's assessment that it falls outside the intended threat model. The CVSS score is low (2.3), reflecting limited exploitability and impact.

No official fix or patch is currently planned by the vendor. Users should be aware of this edge case and avoid relying on IN_PLACE mode to sanitize DOM elements originating from different windows or realms (e.g., iframe contentDocuments). Alternative sanitization approaches or manual validation should be considered in such scenarios. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.