What's an example of a modification to DOM spec that introduces vulnerabilities? I'm not sure I'm familiar with any.
document.cookie = 'secret=123'; const parser = new DOMParser(); const html = parser.parseFromString('', 'text/html'); console.log(html.cookie);
prints secret=123 because of an improperly implemented inheritance model. other browsers do NOT inherit cookies from main document as a result of following the spec closer