CVE-2026-66010 is a medium severity vulnerability in DOMPurify before version 3.4.12. The issue arises because the afterSanitizeElements hook does not execute for custom elements permitted by CUSTOM_ELEMENT_HANDLING.tagNameCheck, allowing certain attributes to bypass sanitization. This can lead to the preservation of sensitive attributes on custom elements, which attackers can exploit to create second-order cross-site scripting (XSS) gadgets by re-injecting these attributes into innerHTML sinks.

Attackers can exploit this vulnerability to bypass application security policies and inject malicious scripts via custom elements, potentially leading to second-order XSS attacks. This can compromise the integrity of web pages and potentially lead to unauthorized script execution in users' browsers.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Users should upgrade to DOMPurify version 3.4.12 or later once available, as this version addresses the issue by properly executing the afterSanitizeElements hook for custom elements. Until an official fix is confirmed, consider restricting or carefully validating custom elements and their attributes to mitigate risk.