Generic HTML Sanitizer Bypass Investigation

I stumbled over a weird HTML behavior on Twitter and started to investigate it. Did I just stumble over a generic HTML Sanitizer bypass? Get my handwritten font (advertisement) Checkout our courses on (advertisement) The Tweet: Google XSS: HTML Spec: #parse-error-invalid-first-character-of-tag-name Chapters: 00:00 - Intro 01:09 - Sanitizing vs. Encoding 02:32 - Developing HTML Sanitizer Bypass 05:03 - Attacking DOMPurify 07:08 - Attacking Server-side Sanitizer 08:31 - HTML Parse Error Specification 10:08 - Potential Impact 11:55 - =[ ❤️ Support ]= → per Video: → per Month: 2nd Channel: =[ 🐕 Social ]= → Twitter: → Streaming: → TikTok: @liveoverflow_ → Instagram: → Blog: → Subreddit: → Facebook: