CVE-2026-66843 is a low-severity vulnerability in the html_sanitize_ex library by rrrene. It involves the inclusion of functionality from an untrusted control sphere via the data attribute of an <object> element in sanitized HTML. This allows a remote attacker to load arbitrary documents into a trusted page. However, this is not unconditional cross-site scripting, as javascript: URLs do not execute through <object data> in current browsers, and data: documents load in an opaque origin. Exploitation requires the application to serve attacker-controlled content from a same-origin path.