@lwrjs/client-modules 0.22.14 → 0.22.16

package/build/modules/lwr/lockerDefine/lockerDefine.js

@@ -582,6 +582,7 @@ const {
   indexOf: StringProtoIndexOf$LWS,
   lastIndexOf: StringProtoLastIndexOf$LWS,
   match: StringProtoMatch$LWS,
+  normalize: StringProtoNormalize$LWS,
   replace: StringProtoReplace$LWS,
   slice: StringProtoSlice$LWS$1,
   split: StringProtoSplit$LWS,
@@ -1509,7 +1510,7 @@ const {
 const PromiseResolve$LWS = PromiseCtor$LWS.resolve.bind(PromiseCtor$LWS);
 const PromiseReject$LWS = PromiseCtor$LWS.reject.bind(PromiseCtor$LWS);
 const trustedResources$LWS = toSafeSet$LWS(new SetCtor$LWS$1());
-/*! version: 0.26.4 */
+/*! version: 0.27.5 */
 
 /*!
  * Copyright (C) 2019 salesforce.com, inc.
@@ -1571,86 +1572,6 @@ const {
   append: DocumentFragmentProtoAppend$LWS,
   getElementById: DocumentFragmentProtoGetElementById$LWS
 } = DocumentFragment.prototype;
-const {
-  prototype: ElementProto$LWS
-} = Element;
-const ElementAriaAttributesToPropertyName$LWS = {
-  __proto__: null,
-  'aria-activedescendant': 'ariaActiveDescendant',
-  'aria-atomic': 'ariaAtomic',
-  'aria-autocomplete': 'ariaAutoComplete',
-  'aria-busy': 'ariaBusy',
-  'aria-checked': 'ariaChecked',
-  'aria-colcount': 'ariaColCount',
-  'aria-colindex': 'ariaColIndex',
-  'aria-colspan': 'ariaColSpan',
-  'aria-controls': 'ariaControls',
-  'aria-current': 'ariaCurrent',
-  'aria-describedby': 'ariaDescribedBy',
-  'aria-details': 'ariaDetails',
-  'aria-disabled': 'ariaDisabled',
-  'aria-errormessage': 'ariaErrorMessage',
-  'aria-expanded': 'ariaExpanded',
-  'aria-flowto': 'ariaFlowTo',
-  'aria-haspopup': 'ariaHasPopup',
-  'aria-hidden': 'ariaHidden',
-  'aria-invalid': 'ariaInvalid',
-  'aria-keyshortcuts': 'ariaKeyShortcuts',
-  'aria-label': 'ariaLabel',
-  'aria-labelledby': 'ariaLabelledBy',
-  'aria-level': 'ariaLevel',
-  'aria-live': 'ariaLive',
-  'aria-modal': 'ariaModal',
-  'aria-multiline': 'ariaMultiLine',
-  'aria-multiselectable': 'ariaMultiSelectable',
-  'aria-orientation': 'ariaOrientation',
-  'aria-owns': 'ariaOwns',
-  'aria-placeholder': 'ariaPlaceholder',
-  'aria-posinset': 'ariaPosInSet',
-  'aria-pressed': 'ariaPressed',
-  'aria-readonly': 'ariaReadOnly',
-  'aria-relevant': 'ariaRelevant',
-  'aria-required': 'ariaRequired',
-  'aria-roledescription': 'ariaRoleDescription',
-  'aria-rowcount': 'ariaRowCount',
-  'aria-rowindex': 'ariaRowIndex',
-  'aria-rowspan': 'ariaRowSpan',
-  'aria-selected': 'ariaSelected',
-  'aria-setsize': 'ariaSetSize',
-  'aria-sort': 'ariaSort',
-  'aria-valuemax': 'ariaValueMax',
-  'aria-valuemin': 'ariaValueMin',
-  'aria-valuenow': 'ariaValueNow',
-  'aria-valuetext': 'ariaValueText'
-};
-// Used by '@locker/near-membrane-dom'.
-const {
-  remove: ElementProtoRemove$LWS$1
-} = ElementProto$LWS;
-const {
-  closest: ElementProtoClosest$LWS,
-  getAttribute: ElementProtoGetAttribute$LWS,
-  getAttributeNode: ElementProtoGetAttributeNode$LWS,
-  getAttributeNodeNS: ElementProtoGetAttributeNodeNS$LWS,
-  hasAttribute: ElementProtoHasAttribute$LWS,
-  querySelector: ElementProtoQuerySelector$LWS,
-  querySelectorAll: ElementProtoQuerySelectorAll$LWS,
-  removeAttribute: ElementProtoRemoveAttribute$LWS,
-  removeAttributeNode: ElementProtoRemoveAttributeNode$LWS,
-  removeAttributeNS: ElementProtoRemoveAttributeNS$LWS,
-  setAttribute: ElementProtoSetAttribute$LWS$1,
-  setAttributeNS: ElementProtoSetAttributeNS$LWS,
-  toggleAttribute: ElementProtoToggleAttribute$LWS
-} = ElementProto$LWS;
-const {
-  get: ElementProtoInnerHTMLGetter$LWS,
-  set: ElementProtoInnerHTMLSetter$LWS
-} = ReflectGetOwnPropertyDescriptor$LWS(ElementProto$LWS, 'innerHTML');
-const ElementProtoNamespaceURIGetter$LWS = ObjectLookupOwnGetter$LWS$1(ElementProto$LWS, 'namespaceURI');
-const {
-  get: ElementProtoOuterHTMLGetter$LWS
-} = ReflectGetOwnPropertyDescriptor$LWS(ElementProto$LWS, 'outerHTML');
-const ElementProtoTagNameGetter$LWS = ObjectLookupOwnGetter$LWS$1(ElementProto$LWS, 'tagName');
 
 // Check for the noopener feature being enabled:
 // - noopener
@@ -1730,17 +1651,9 @@ function initWindowOpenChildWindow$LWS(win$LWS, url$LWS) {
   }
   return win$LWS;
 }
-// This is only used by window.open() and document.open(x, y, z) distortions to
-// block access to unsafe properties of the child window that's returned by those
-// APIs. These properties must be otherwise available directly on the sandbox window,
-// or via iframe.contentWindow created within the sandbox.
-// To be effective, we mark the blocked thing with a symbol, so that can be detected by
-// the distortion, otherwise the distortion will replace whatever we define here with
-// whatever it provides.
 const CHILD_WINDOW_BLOCKED_PROPERTY_SYMBOL$LWS = SymbolFor$LWS$1('@@lwsChildWindowBlockedProperty');
 const CHILD_WINDOW_BLOCKED_PROPERTIES$LWS = ['eval', 'Function', 'setInterval', 'setTimeout'];
 function markForUnsafePropertyBlocking$LWS(childWindow$LWS) {
-  // If this function somehow receives the rootWindow, just return it.
   if (!childWindow$LWS || childWindow$LWS === rootWindow$LWS$1) {
     return childWindow$LWS;
   }
@@ -1759,23 +1672,11 @@ function markForUnsafePropertyBlocking$LWS(childWindow$LWS) {
     if (typeof childWindow$LWS[blocked$LWS] === 'function') {
       descriptor$LWS.value = replacement$LWS;
     }
-    /* Eventually there will be other types of blocked properties
-    else {
-        descriptor.get = replacement;
-    }
-    */
     ReflectDefineProperty$LWS$1(childWindow$LWS, blocked$LWS, descriptor$LWS);
   }
   return childWindow$LWS;
 }
 function throwIfMarkedAsUnsafeInChildWindow$LWS(virtualEnvironmentEvaluator$LWS, name$LWS) {
-  // This seemingly strange approach is necessary because this distortion will
-  // otherwise replace whatever was force-assigned to the childWindow property
-  // by markForUnsafePropertyBlocking with this distortion, effectively acting
-  // as an UNDO of markForUnsafePropertyBlocking(). We have to dig into
-  // the sandbox's global object and look at the actual property to see if it was
-  // marked for unsafe property blocking, because indirect property (ie. eval) will bypass
-  // any "this" property lookups.
   const getPossiblyBlockedPropertyFromSandbox$LWS = virtualEnvironmentEvaluator$LWS(`() => globalThis.${name$LWS}`);
   // istanbul ignore else: it is unnecessary to cover the else path here
   if (getPossiblyBlockedPropertyFromSandbox$LWS()[CHILD_WINDOW_BLOCKED_PROPERTY_SYMBOL$LWS]) {
@@ -1845,6 +1746,153 @@ function normalizeWindowOpenArguments$LWS(args$LWS) {
   }
   return normalizedArgs$LWS;
 }
+const {
+  // We don't cherry-pick the 'userAgent' property from `navigator` here
+  // to avoid triggering its getter.
+  navigator: navigator$LWS$1,
+  navigator: {
+    userAgentData: userAgentData$LWS$1
+  }
+} = rootWindow$LWS$1;
+// The user-agent client hints API is experimental and subject to change.
+// https://caniuse.com/mdn-api_navigator_useragentdata
+// istanbul ignore next: optional chaining and nullish coalescing results in an expansion that contains an unreachable "void 0" branch for every occurrence of the operator
+const brands$LWS$1 = userAgentData$LWS$1 == null ? void 0 : userAgentData$LWS$1.brands;
+// Note: Chromium identifies itself as Chrome in its user-agent string.
+// https://developer.mozilla.org/en-US/docs/Web/HTTP/Browser_detection_using_the_user_agent
+const chromiumUserAgentRegExp$LWS$1 = / (?:Headless)?Chrome\/\d+/;
+const webKitUserAgentRegExp$LWS = /WebKit/i;
+let userAgent$LWS$1;
+function getUserAgent$LWS$1() {
+  if (userAgent$LWS$1 === undefined) {
+    userAgent$LWS$1 = navigator$LWS$1.userAgent;
+  }
+  return userAgent$LWS$1;
+}
+const CUSTOM_ELEMENT_REGISTRY_ATTRIBUTE_NAME$LWS = LOCKER_SERVICE_KEY_LOWERED$LWS;
+// Used by '@locker/near-membrane-dom'.
+const IS_CHROMIUM_BROWSER$LWS$1 =
+// While experimental, `navigator.userAgentData.brands` may be defined as an
+// empty array in headless Chromium based browsers.
+ArrayIsArray$LWS$1(brands$LWS$1) && brands$LWS$1.length ?
+// Use user-agent client hints API if available to avoid deprecation
+// warnings.
+// https://developer.mozilla.org/en-US/docs/Web/API/User-Agent_Client_Hints_API
+// istanbul ignore next: this code is not reachable in the coverage run.
+ReflectApply$LWS$1(ArrayProtoFind$LWS$1, brands$LWS$1, [
+// prettier-ignore
+// istanbul ignore next: this code is not reachable in the coverage run.
+item$LWS => (item$LWS == null ? void 0 : item$LWS.brand) === 'Chromium']) !== undefined :
+// Fallback to a standard user-agent string sniff.
+ReflectApply$LWS$1(RegExpProtoTest$LWS$1, chromiumUserAgentRegExp$LWS$1, [getUserAgent$LWS$1()]);
+const IS_WEBKIT_BROWSER$LWS = !IS_CHROMIUM_BROWSER$LWS$1 && (
+// istanbul ignore next: this code is not reachable in the coverage run.
+ArrayIsArray$LWS$1(brands$LWS$1) && brands$LWS$1.length ? ReflectApply$LWS$1(ArrayProtoFind$LWS$1, brands$LWS$1, [
+// istanbul ignore next
+item$LWS => {
+  const brand$LWS = item$LWS == null ? void 0 : item$LWS.brand;
+  return typeof brand$LWS === 'string' && ReflectApply$LWS$1(RegExpProtoTest$LWS$1, webKitUserAgentRegExp$LWS, [brand$LWS]);
+}]) !== undefined : ReflectApply$LWS$1(RegExpProtoTest$LWS$1, webKitUserAgentRegExp$LWS, [getUserAgent$LWS$1()]));
+// Pattern to match CSP nonce values, e.g., 'nonce-abc123'
+// The nonce value is base64 encoded and may contain alphanumeric characters, +, /, and =
+const NONCE_PATTERN$LWS = /'nonce-[A-Za-z0-9+/=]+'/g;
+const BLOCKED_ELEMENTS$LWS = toSafeSet$LWS(new SetCtor$LWS$1(['base']));
+function isBlockedElement$LWS(tagName$LWS) {
+  return BLOCKED_ELEMENTS$LWS.has(tagName$LWS);
+}
+const {
+  prototype: ElementProto$LWS
+} = Element;
+const ElementAriaAttributesToPropertyName$LWS = {
+  __proto__: null,
+  'aria-activedescendant': 'ariaActiveDescendant',
+  'aria-atomic': 'ariaAtomic',
+  'aria-autocomplete': 'ariaAutoComplete',
+  'aria-busy': 'ariaBusy',
+  'aria-checked': 'ariaChecked',
+  'aria-colcount': 'ariaColCount',
+  'aria-colindex': 'ariaColIndex',
+  'aria-colspan': 'ariaColSpan',
+  'aria-controls': 'ariaControls',
+  'aria-current': 'ariaCurrent',
+  'aria-describedby': 'ariaDescribedBy',
+  'aria-details': 'ariaDetails',
+  'aria-disabled': 'ariaDisabled',
+  'aria-errormessage': 'ariaErrorMessage',
+  'aria-expanded': 'ariaExpanded',
+  'aria-flowto': 'ariaFlowTo',
+  'aria-haspopup': 'ariaHasPopup',
+  'aria-hidden': 'ariaHidden',
+  'aria-invalid': 'ariaInvalid',
+  'aria-keyshortcuts': 'ariaKeyShortcuts',
+  'aria-label': 'ariaLabel',
+  'aria-labelledby': 'ariaLabelledBy',
+  'aria-level': 'ariaLevel',
+  'aria-live': 'ariaLive',
+  'aria-modal': 'ariaModal',
+  'aria-multiline': 'ariaMultiLine',
+  'aria-multiselectable': 'ariaMultiSelectable',
+  'aria-orientation': 'ariaOrientation',
+  'aria-owns': 'ariaOwns',
+  'aria-placeholder': 'ariaPlaceholder',
+  'aria-posinset': 'ariaPosInSet',
+  'aria-pressed': 'ariaPressed',
+  'aria-readonly': 'ariaReadOnly',
+  'aria-relevant': 'ariaRelevant',
+  'aria-required': 'ariaRequired',
+  'aria-roledescription': 'ariaRoleDescription',
+  'aria-rowcount': 'ariaRowCount',
+  'aria-rowindex': 'ariaRowIndex',
+  'aria-rowspan': 'ariaRowSpan',
+  'aria-selected': 'ariaSelected',
+  'aria-setsize': 'ariaSetSize',
+  'aria-sort': 'ariaSort',
+  'aria-valuemax': 'ariaValueMax',
+  'aria-valuemin': 'ariaValueMin',
+  'aria-valuenow': 'ariaValueNow',
+  'aria-valuetext': 'ariaValueText'
+};
+// Used by '@locker/near-membrane-dom'.
+const {
+  remove: ElementProtoRemove$LWS$1
+} = ElementProto$LWS;
+const {
+  closest: ElementProtoClosest$LWS,
+  getAttribute: ElementProtoGetAttribute$LWS,
+  getAttributeNode: ElementProtoGetAttributeNode$LWS,
+  getAttributeNodeNS: ElementProtoGetAttributeNodeNS$LWS,
+  hasAttribute: ElementProtoHasAttribute$LWS,
+  querySelector: ElementProtoQuerySelector$LWS,
+  querySelectorAll: ElementProtoQuerySelectorAll$LWS,
+  removeAttribute: ElementProtoRemoveAttribute$LWS,
+  removeAttributeNode: ElementProtoRemoveAttributeNode$LWS,
+  removeAttributeNS: ElementProtoRemoveAttributeNS$LWS,
+  setAttribute: ElementProtoSetAttribute$LWS$1,
+  setAttributeNS: ElementProtoSetAttributeNS$LWS,
+  toggleAttribute: ElementProtoToggleAttribute$LWS
+} = ElementProto$LWS;
+const {
+  get: ElementProtoInnerHTMLGetter$LWS,
+  set: ElementProtoInnerHTMLSetter$LWS
+} = ReflectGetOwnPropertyDescriptor$LWS(ElementProto$LWS, 'innerHTML');
+const ElementProtoNamespaceURIGetter$LWS = ObjectLookupOwnGetter$LWS$1(ElementProto$LWS, 'namespaceURI');
+const {
+  get: ElementProtoOuterHTMLGetter$LWS
+} = ReflectGetOwnPropertyDescriptor$LWS(ElementProto$LWS, 'outerHTML');
+const ElementProtoTagNameGetter$LWS = ObjectLookupOwnGetter$LWS$1(ElementProto$LWS, 'tagName');
+/**
+ * Removes CSP nonce patterns from a string.
+ *
+ * CSP nonces (e.g., 'nonce-abc123') are cryptographic tokens used to allowlist
+ * inline scripts/styles. This function strips them from serialized content to
+ * prevent nonce exfiltration attacks.
+ *
+ * @param content - The string to sanitize (e.g., innerHTML, CSP content attribute)
+ * @returns The string with all 'nonce-xxx' patterns removed
+ */
+function removeNoncePatterns$LWS(content$LWS) {
+  return ReflectApply$LWS$1(StringProtoReplace$LWS, content$LWS, [NONCE_PATTERN$LWS, '']);
+}
 const HTMLElement$LWS = getUnmaskedFunction$LWS(rootWindow$LWS$1.HTMLElement);
 const {
   prototype: HTMLElementProto$LWS
@@ -1880,6 +1928,32 @@ ObjectLookupOwnGetter$LWS$1(NodeProto$LWS$1, 'parentNode');
 ReflectGetOwnPropertyDescriptor$LWS(NodeProto$LWS$1, 'textContent');
 const rootDocumentDetachedFragment$LWS = ReflectApply$LWS$1(DocumentProtoCreateDocumentFragment$LWS, rootDocument$LWS, []);
 const rootDocumentDetachedContainer$LWS = ReflectApply$LWS$1(DocumentProtoCreateElement$LWS$1, rootDocument$LWS, ['div']);
+// Regex to match null bytes and zero-width characters that browsers may strip or ignore
+// \x00 - Null byte
+// \u00AD - Soft Hyphen
+// \u034F - Combining Grapheme Joiner
+// \u200B - Zero Width Space
+// \u200C - Zero Width Non-Joiner
+// \u200D - Zero Width Joiner
+// \u2060 - Word Joiner
+// \uFEFF - Zero Width No-Break Space (BOM)
+// eslint-disable-next-line no-control-regex, no-misleading-character-class
+const INVISIBLE_CHARS_REGEX$LWS = /[\x00\u00AD\u034F\u200B\u200C\u200D\u2060\uFEFF]/g;
+function normalizeInput$LWS(input$LWS, replacement$LWS = '') {
+  // Replace invisible characters with space (not remove) to preserve token boundaries
+  // This ensures DOCTYPE and the root element name remain separate tokens
+  const lowerCasedInput$LWS = ReflectApply$LWS$1(StringProtoToLowerCase$LWS, toSafeStringValue$LWS(input$LWS), []);
+  return ReflectApply$LWS$1(StringProtoReplace$LWS, lowerCasedInput$LWS, [INVISIBLE_CHARS_REGEX$LWS, replacement$LWS]);
+}
+// Regex to detect DOCTYPE with internal DTD subset containing entity definitions.
+// Matches: <!DOCTYPE root [...anything...]>
+// The internal subset can contain ENTITY, ELEMENT, ATTLIST, NOTATION declarations.
+// This is an XXE attack vector where entities can contain malicious script content.
+const DOCTYPE_WITH_INTERNAL_SUBSET_REGEX$LWS = /<!doctype\s+\S+\s*\[/;
+// Regex to detect DOCTYPE with SYSTEM or PUBLIC external entity references.
+// Matches: <!DOCTYPE root SYSTEM "..."> or <!DOCTYPE root PUBLIC "..." "...">
+// External DTDs can define entities that get expanded with malicious content.
+const DOCTYPE_EXTERNAL_ENTITY_REGEX$LWS = /<!doctype\s+\S+\s+(?:system|public)\s/;
 /* eslint-disable no-underscore-dangle */
 class Validator$LWS {
   constructor(document$LWS, {
@@ -1893,10 +1967,32 @@ class Validator$LWS {
       ReflectApply$LWS$1(ElementProtoInnerHTMLSetter$LWS, this._templates.right, [rightString$LWS]);
       return deepIsEqualNode$LWS(this._templates.left, this._templates.right);
     };
+    // Detect XML External Entity (XXE) injection attacks via DOCTYPE declarations.
+    // Attackers can embed malicious script content inside ENTITY definitions that
+    // get expanded when the XML/SVG is rendered, bypassing DOMPurify sanitization.
+    // eslint-disable-next-line class-methods-use-this
+    this.isXMLEntityAttack = input$LWS => {
+      const normalizedInput$LWS = normalizeInput$LWS(input$LWS, ' ');
+      // Block DOCTYPE with:
+      // - Internal DTD subset (e.g., <!DOCTYPE svg [<!ENTITY foo "...">]>)
+      // - SYSTEM or PUBLIC external entity references
+      return ReflectApply$LWS$1(RegExpProtoTest$LWS$1, DOCTYPE_WITH_INTERNAL_SUBSET_REGEX$LWS, [normalizedInput$LWS]) || ReflectApply$LWS$1(RegExpProtoTest$LWS$1, DOCTYPE_EXTERNAL_ENTITY_REGEX$LWS, [normalizedInput$LWS]);
+    };
+    // Detect namespaced script elements that execute in XML contexts.
+    // HTML-mode sanitizers treat <prefix:script> as an inert unknown element,
+    // but XML parsers resolve the namespace and create an executable script
+    // when the namespace is XHTML or SVG. The namespace URL itself can be
+    // obfuscated with XML character entities in attribute values, but the
+    // xmlns attribute name cannot, so checking for "xmlns" is reliable.
+    // eslint-disable-next-line class-methods-use-this
+    this.isXMLNamespacedScriptAttack = input$LWS => {
+      const normalizedInput$LWS = normalizeInput$LWS(input$LWS);
+      return hasTag$LWS(normalizedInput$LWS, 'script') && ReflectApply$LWS$1(StringProtoIncludes$LWS, normalizedInput$LWS, ['xmlns']);
+    };
     // There is no reason to ever allow any HTML or XML that contains all three of these substrings.
     // eslint-disable-next-line class-methods-use-this
-    this.isInherentlyUnsecure = input$LWS => {
-      const normalizedInput$LWS = ReflectApply$LWS$1(StringProtoToLowerCase$LWS, toSafeStringValue$LWS(input$LWS), []);
+    this.isIframeSrcdocScriptAttack = input$LWS => {
+      const normalizedInput$LWS = normalizeInput$LWS(input$LWS);
       const hasIframe$LWS = hasTag$LWS(normalizedInput$LWS, 'iframe') && ReflectApply$LWS$1(StringProtoIncludes$LWS, normalizedInput$LWS, ['srcdoc']);
       const hasScript$LWS = hasTag$LWS(normalizedInput$LWS, 'script');
       // If neither an iframe or a script was detected, then this input is safe.
@@ -1928,7 +2024,14 @@ class Validator$LWS {
       ReflectApply$LWS$1(ElementProtoRemove$LWS$1, rootDocumentDetachedContainer$LWS, []);
       // If innerHTML contains "script", but innerText does not, then the string
       // was hiding a script element through some kind of obfuscation, and is unsecure.
-      return hasTag$LWS(innerHTML$LWS, 'script') && !hasTag$LWS(innerText$LWS, 'script');
+      let checkableInnerText$LWS = innerText$LWS;
+      if (isGaterEnabledFeature$LWS('changesSince.262')) {
+        // Strip < > : from innerText before checking, because HTML entities like
+        // &lt;script&gt; decode to <script> in text content and would otherwise
+        // trick hasTag into thinking visible text contains a script tag.
+        checkableInnerText$LWS = ReflectApply$LWS$1(StringProtoReplace$LWS, innerText$LWS, [/[<>:]/g, '']);
+      }
+      return hasTag$LWS(innerHTML$LWS, 'script') && !hasTag$LWS(checkableInnerText$LWS, 'script');
     };
     this.isSharedElement = element$LWS => element$LWS === ReflectApply$LWS$1(DocumentProtoHeadGetter$LWS, this._document, []) || element$LWS === ReflectApply$LWS$1(DocumentProtoBodyGetter$LWS$1, this._document, []) || element$LWS === ReflectApply$LWS$1(DocumentProtoDocumentElementGetter$LWS, this._document, []);
     this._constructors = {
@@ -1965,10 +2068,13 @@ function deepIsEqualNode$LWS(leftRoot$LWS, rightRoot$LWS) {
 function hasTag$LWS(input$LWS, tag$LWS) {
   let checkableInput$LWS = input$LWS;
   if (isGaterEnabledFeature$LWS('changesSince.256')) {
-    const lowerCasedInput$LWS = ReflectApply$LWS$1(StringProtoToLowerCase$LWS, input$LWS, []);
-    checkableInput$LWS = ReflectApply$LWS$1(StringProtoReplace$LWS, lowerCasedInput$LWS, [/\s+/g, ' ']);
+    // Input is already lowercased and invisible chars stripped by caller
+    checkableInput$LWS = ReflectApply$LWS$1(StringProtoReplace$LWS, input$LWS, [/\s+/g, ' ']);
   }
-  return ReflectApply$LWS$1(StringProtoIncludes$LWS, checkableInput$LWS, [`<${tag$LWS} `]) || ReflectApply$LWS$1(StringProtoIncludes$LWS, checkableInput$LWS, [`:${tag$LWS} `]) || ReflectApply$LWS$1(StringProtoIncludes$LWS, checkableInput$LWS, [`<${tag$LWS}>`]) || ReflectApply$LWS$1(StringProtoIncludes$LWS, checkableInput$LWS, [`:${tag$LWS}>`]);
+  // Match <tag or :tag (namespaced) followed by whitespace, >, /
+  // Also match when directly followed by src or srcdoc (null byte was stripped)
+  const tagPattern$LWS = new RegExpCtor$LWS$1(`[<:]${tag$LWS}(?:[\\s>/]|(?=src))`);
+  return ReflectApply$LWS$1(RegExpProtoTest$LWS$1, tagPattern$LWS, [checkableInput$LWS]);
 }
 const rootValidator$LWS = new Validator$LWS(rootDocument$LWS, rootWindow$LWS$1);
 const documentToValidatorMap$LWS = toSafeWeakMap$LWS$1(new WeakMapCtor$LWS$1([[rootDocument$LWS, rootValidator$LWS]]));
@@ -1996,53 +2102,6 @@ const {
 } = BlobProto$LWS;
 const BlobProtoSizeGetter$LWS = ObjectLookupOwnGetter$LWS$1(BlobProto$LWS, 'size');
 const BlobProtoTypeGetter$LWS = ObjectLookupOwnGetter$LWS$1(BlobProto$LWS, 'type');
-const {
-  // We don't cherry-pick the 'userAgent' property from `navigator` here
-  // to avoid triggering its getter.
-  navigator: navigator$LWS$1,
-  navigator: {
-    userAgentData: userAgentData$LWS$1
-  }
-} = rootWindow$LWS$1;
-// The user-agent client hints API is experimental and subject to change.
-// https://caniuse.com/mdn-api_navigator_useragentdata
-// istanbul ignore next: optional chaining and nullish coalescing results in an expansion that contains an unreachable "void 0" branch for every occurrence of the operator
-const brands$LWS$1 = userAgentData$LWS$1 == null ? void 0 : userAgentData$LWS$1.brands;
-// Note: Chromium identifies itself as Chrome in its user-agent string.
-// https://developer.mozilla.org/en-US/docs/Web/HTTP/Browser_detection_using_the_user_agent
-const chromiumUserAgentRegExp$LWS$1 = / (?:Headless)?Chrome\/\d+/;
-const webKitUserAgentRegExp$LWS = /WebKit/i;
-let userAgent$LWS$1;
-function getUserAgent$LWS$1() {
-  if (userAgent$LWS$1 === undefined) {
-    userAgent$LWS$1 = navigator$LWS$1.userAgent;
-  }
-  return userAgent$LWS$1;
-}
-const CUSTOM_ELEMENT_REGISTRY_ATTRIBUTE_NAME$LWS = LOCKER_SERVICE_KEY_LOWERED$LWS;
-// Used by '@locker/near-membrane-dom'.
-const IS_CHROMIUM_BROWSER$LWS$1 =
-// While experimental, `navigator.userAgentData.brands` may be defined as an
-// empty array in headless Chromium based browsers.
-ArrayIsArray$LWS$1(brands$LWS$1) && brands$LWS$1.length ?
-// Use user-agent client hints API if available to avoid deprecation
-// warnings.
-// https://developer.mozilla.org/en-US/docs/Web/API/User-Agent_Client_Hints_API
-// istanbul ignore next: this code is not reachable in the coverage run.
-ReflectApply$LWS$1(ArrayProtoFind$LWS$1, brands$LWS$1, [
-// prettier-ignore
-// istanbul ignore next: this code is not reachable in the coverage run.
-item$LWS => (item$LWS == null ? void 0 : item$LWS.brand) === 'Chromium']) !== undefined :
-// Fallback to a standard user-agent string sniff.
-ReflectApply$LWS$1(RegExpProtoTest$LWS$1, chromiumUserAgentRegExp$LWS$1, [getUserAgent$LWS$1()]);
-const IS_WEBKIT_BROWSER$LWS = !IS_CHROMIUM_BROWSER$LWS$1 && (
-// istanbul ignore next: this code is not reachable in the coverage run.
-ArrayIsArray$LWS$1(brands$LWS$1) && brands$LWS$1.length ? ReflectApply$LWS$1(ArrayProtoFind$LWS$1, brands$LWS$1, [
-// istanbul ignore next
-item$LWS => {
-  const brand$LWS = item$LWS == null ? void 0 : item$LWS.brand;
-  return typeof brand$LWS === 'string' && ReflectApply$LWS$1(RegExpProtoTest$LWS$1, webKitUserAgentRegExp$LWS, [brand$LWS]);
-}]) !== undefined : ReflectApply$LWS$1(RegExpProtoTest$LWS$1, webKitUserAgentRegExp$LWS, [getUserAgent$LWS$1()]));
 
 // Used by '@locker/near-membrane-shared-dom'.
 // The DOMException constructor was exposed in Edge 12 but wasn't invocable
@@ -2087,6 +2146,20 @@ const {
 } = ReflectGetOwnPropertyDescriptor$LWS(HTMLAnchorElementProto$LWS, 'href');
 const HTMLAnchorElementProtoPathnameGetter$LWS = ObjectLookupOwnGetter$LWS$1(HTMLAnchorElementProto$LWS, 'pathname');
 const HTMLAnchorElementProtoProtocolGetter$LWS = ObjectLookupOwnGetter$LWS$1(HTMLAnchorElementProto$LWS, 'protocol');
+const {
+  prototype: HTMLButtonElementProto$LWS
+} = HTMLButtonElement;
+const {
+  get: HTMLButtonElementProtoFormActionGetter$LWS,
+  set: HTMLButtonElementProtoFormActionSetter$LWS
+} = ReflectGetOwnPropertyDescriptor$LWS(HTMLButtonElementProto$LWS, 'formAction');
+const {
+  prototype: HTMLFormElementProto$LWS
+} = HTMLFormElement;
+const {
+  get: HTMLFormElementProtoActionGetter$LWS,
+  set: HTMLFormElementProtoActionSetter$LWS
+} = ReflectGetOwnPropertyDescriptor$LWS(HTMLFormElementProto$LWS, 'action');
 const {
   prototype: HTMLIFrameElementProto$LWS
 } = HTMLIFrameElement;
@@ -2096,6 +2169,13 @@ const HTMLIFrameElementProtoSandboxGetter$LWS = ObjectLookupOwnGetter$LWS$1(HTML
 const HTMLIFrameElementProtoSandboxSetter$LWS = ObjectLookupOwnSetter$LWS(HTMLIFrameElementProto$LWS, 'sandbox');
 const HTMLIFrameElementProtoSrcGetter$LWS = ObjectLookupOwnGetter$LWS$1(HTMLIFrameElementProto$LWS, 'src');
 const HTMLIFrameElementProtoSrcSetter$LWS = ObjectLookupOwnSetter$LWS(HTMLIFrameElementProto$LWS, 'src');
+const {
+  prototype: HTMLInputElementProto$LWS
+} = HTMLInputElement;
+const {
+  get: HTMLInputElementProtoFormActionGetter$LWS,
+  set: HTMLInputElementProtoFormActionSetter$LWS
+} = ReflectGetOwnPropertyDescriptor$LWS(HTMLInputElementProto$LWS, 'formAction');
 const HTMLScriptElementCtor$LWS = HTMLScriptElement;
 const {
   prototype: HTMLScriptElementProto$LWS
@@ -2175,6 +2255,13 @@ function getOriginalScriptProperty$LWS(script$LWS) {
 function isScriptEvaluated$LWS(script$LWS) {
   return evaluatedScriptElements$LWS.has(script$LWS);
 }
+function isUnknownScriptElement$LWS(element$LWS, globalObject$LWS) {
+  const {
+    HTMLScriptElement: HTMLScriptElement$LWS,
+    SVGScriptElement: SVGScriptElement$LWS
+  } = globalObject$LWS;
+  return (element$LWS instanceof HTMLScriptElement$LWS || element$LWS instanceof SVGScriptElement$LWS) && !originalScriptPropertyCache$LWS.has(element$LWS) && !evaluatedScriptElements$LWS.has(element$LWS);
+}
 function isScriptPropertyEvaluatorHookDefined$LWS(script$LWS) {
   return originalScriptPropertyCache$LWS.has(script$LWS);
 }
@@ -2290,7 +2377,7 @@ const {
 const XhrProtoResponseTextGetter$LWS = ObjectLookupOwnGetter$LWS$1(XhrProto$LWS, 'responseText');
 const XhrProtoStatusGetter$LWS = ObjectLookupOwnGetter$LWS$1(XhrProto$LWS, 'status');
 ObjectLookupOwnSetter$LWS(XhrProto$LWS, 'withCredentials');
-/*! version: 0.26.4 */
+/*! version: 0.27.5 */
 
 /*!
  * Copyright (C) 2019 salesforce.com, inc.
@@ -2312,6 +2399,10 @@ function isMIMETypeAllowed$LWS(mimeType$LWS) {
   return false;
 }
 const DISALLOWED_ENDPOINTS_LIST$LWS = ['/aura', '/webruntime'];
+// Endpoints that should not be used as browsing context targets (window.open, iframe.src)
+// because they return manipulable content. Unlike fetch/XHR which just return data,
+// browsing contexts can be manipulated by attackers to inject malicious DOM.
+const DISALLOWED_BROWSING_CONTEXT_ENDPOINTS_LIST$LWS = ['/chatter'];
 const TRUSTED_DOMAINS_REG_EXP$LWS = /\.(force|salesforce|visualforce|documentforce|my\.site|salesforce-sites)\.com$/;
 const URL_SCHEMES_LIST$LWS = toSafeArray$LWS$1(['about:', 'http:', 'https:']);
 const newlinesAndTabsRegExp$LWS = /[\u2028\u2029\n\r\t]/g;
@@ -2332,9 +2423,21 @@ function isSameOriginURL$LWS(resourceValue$LWS) {
   // then it can be treated as a same-origin URL.
   return resourceUrlOrigin$LWS && resourceUrlOrigin$LWS === rootWindow$LWS$1.location.origin;
 }
+// Detects exploit patterns that abuse the current page context
+function isAttemptingToExploitURL$LWS(resourceValue$LWS) {
+  const loweredResourceValue$LWS = ReflectApply$LWS$1(StringProtoToLowerCase$LWS, resourceValue$LWS, []);
+  const locationHref$LWS = rootWindow$LWS$1.location.href;
+  return loweredResourceValue$LWS === '/' || loweredResourceValue$LWS[0] === '#' || loweredResourceValue$LWS[0] === '?' || ReflectApply$LWS$1(StringProtoStartsWith$LWS, loweredResourceValue$LWS, [`${locationHref$LWS}#`]) || ReflectApply$LWS$1(StringProtoStartsWith$LWS, loweredResourceValue$LWS, [`${locationHref$LWS}?`]);
+}
+// Validates that a URL doesn't target disallowed endpoints
 // @TODO: W-7302311 Make paths and domains configurable.
-function isValidURL$LWS(parsedURL$LWS) {
+function isAllowedEndpointURL$LWS(parsedURL$LWS) {
   const loweredPathname$LWS = ReflectApply$LWS$1(StringProtoToLowerCase$LWS, parsedURL$LWS.pathname, []);
+  // This MUST be done inside the function because the gate may not be enabled when the
+  // module code is loaded and evaluated (as would be the case for test environments)
+  if (isGaterEnabledFeature$LWS('changesSince.262')) {
+    DISALLOWED_ENDPOINTS_LIST$LWS.push('/_nc_external', '/force', '/setup');
+  }
   for (let i$LWS = 0, {
       length: length$LWS
     } = DISALLOWED_ENDPOINTS_LIST$LWS; i$LWS < length$LWS; i$LWS += 1) {
@@ -2344,6 +2447,26 @@ function isValidURL$LWS(parsedURL$LWS) {
   }
   return true;
 }
+// Validates that a URL is safe for browsing context targets (window.open, iframe.src).
+// Unlike fetch/XHR which just return response data, browsing contexts can be
+// manipulated by attackers to inject malicious content.
+// This includes all endpoints blocked by isAllowedEndpointURL plus browsing-context-specific ones.
+function isValidBrowsingContextURL$LWS(parsedURL$LWS) {
+  // First check against the general disallowed endpoints
+  if (!isAllowedEndpointURL$LWS(parsedURL$LWS)) {
+    return false;
+  }
+  // Then check against browsing-context-specific disallowed endpoints
+  const loweredPathname$LWS = ReflectApply$LWS$1(StringProtoToLowerCase$LWS, parsedURL$LWS.pathname, []);
+  for (let i$LWS = 0, {
+      length: length$LWS
+    } = DISALLOWED_BROWSING_CONTEXT_ENDPOINTS_LIST$LWS; i$LWS < length$LWS; i$LWS += 1) {
+    if (ReflectApply$LWS$1(StringProtoEndsWith$LWS, loweredPathname$LWS, [DISALLOWED_BROWSING_CONTEXT_ENDPOINTS_LIST$LWS[i$LWS]]) || ReflectApply$LWS$1(StringProtoIncludes$LWS, loweredPathname$LWS, [`${DISALLOWED_BROWSING_CONTEXT_ENDPOINTS_LIST$LWS[i$LWS]}/`])) {
+      return false;
+    }
+  }
+  return true;
+}
 function isValidURLScheme$LWS(url$LWS) {
   ReflectApply$LWS$1(HTMLAnchorElementProtoHrefSetter$LWS, normalizerAnchor$LWS, [url$LWS]);
   return URL_SCHEMES_LIST$LWS.includes(ReflectApply$LWS$1(HTMLAnchorElementProtoProtocolGetter$LWS, normalizerAnchor$LWS, []));
@@ -2365,7 +2488,7 @@ function sanitizeURLForElement$LWS(url$LWS) {
 function sanitizeURLString$LWS(urlString$LWS) {
   return urlString$LWS === '' ? urlString$LWS : ReflectApply$LWS$1(StringProtoReplace$LWS, urlString$LWS, [newlinesAndTabsRegExp$LWS, '']);
 }
-/*! version: 0.26.4 */
+/*! version: 0.27.5 */
 
 /*! @license DOMPurify 3.2.4 | (c) Cure53 and other contributors | Released under the Apache license 2.0 and Mozilla Public License 2.0 | github.com/cure53/DOMPurify/blob/3.2.4/LICENSE */
 
@@ -3777,7 +3900,7 @@ try {
   // swallow
 }
 const trusted = createPolicy('trusted', policyOptions);
-/*! version: 0.26.4 */
+/*! version: 0.27.5 */
 
 /*!
  * Copyright (C) 2019 salesforce.com, inc.
@@ -3838,7 +3961,7 @@ var CONFIG$LWS = /*#__PURE__*/Object.freeze({
 const instancesBySandboxKeyRegistry$LWS = {
   __proto__: null
 };
-const SANITIZE_ATTRIBUTES_LIST$LWS = toSafeArray$LWS$1(['href', 'xlink:href']);
+const SANITIZE_USE_ELEMENT_ATTRIBUTES_LIST$LWS = toSafeArray$LWS$1(['href', 'xlink:href']);
 const SHARED_SVG_SANITIZER_KEY$LWS = 'SHARED_SVG_SANITIZER_KEY';
 ReflectApply$LWS$1(DocumentProtoCreateElement$LWS$1, document, ['template']);
 // Queue for managing pending XHR requests.
@@ -4022,9 +4145,20 @@ function uponSanitizeAttribute$LWS(node$LWS, data$LWS, _config$LWS) {
     attrValue: attrValue$LWS,
     attrName: attrName$LWS
   } = data$LWS;
-  if (attrValue$LWS && ReflectApply$LWS$1(StringProtoToUpperCase$LWS, ReflectApply$LWS$1(NodeProtoNodeNameGetter$LWS, node$LWS, []), []) === 'USE' && SANITIZE_ATTRIBUTES_LIST$LWS.includes(attrName$LWS)) {
+  const nodeName$LWS = ReflectApply$LWS$1(StringProtoToUpperCase$LWS, ReflectApply$LWS$1(NodeProtoNodeNameGetter$LWS, node$LWS, []), []);
+  if (attrValue$LWS && nodeName$LWS === 'USE' && SANITIZE_USE_ELEMENT_ATTRIBUTES_LIST$LWS.includes(attrName$LWS)) {
     data$LWS.attrValue = sanitizeSvgHref$LWS(attrValue$LWS);
   }
+  // Remove action/formaction attributes pointing to disallowed endpoints.
+  // Using keepAttr=false rather than blanking the value so that formaction
+  // removal falls back to the form's own (already validated) action attribute
+  // instead of overriding it with the current page URL.
+  if (isGaterEnabledFeature$LWS('changesSince.262') && attrValue$LWS && (attrName$LWS === 'action' || attrName$LWS === 'formaction') && (nodeName$LWS === 'FORM' || nodeName$LWS === 'BUTTON' || nodeName$LWS === 'INPUT')) {
+    const parsedURL$LWS = parseURL$LWS(attrValue$LWS);
+    if (!isAllowedEndpointURL$LWS(parsedURL$LWS)) {
+      data$LWS.keepAttr = false;
+    }
+  }
   // To support Lit, we must tell DOMPurify that attributes starting with "@", ".", or "?" are allowed.
   // Ref:
   // https://lit.dev/docs/components/events/
@@ -4042,7 +4176,7 @@ function blobSanitizer$LWS(sandboxKey$LWS) {
   }
   return getSanitizerForConfig$LWS(sandboxKey$LWS, 'STRING_BLOB_HTML');
 }
-/*! version: 0.26.4 */
+/*! version: 0.27.5 */
 
 /*!
  * Copyright (C) 2023 salesforce.com, inc.
@@ -4096,7 +4230,8 @@ var ContentType$LWS;
 (function (ContentType$LWS) {
   ContentType$LWS[ContentType$LWS["HTML"] = 0] = "HTML";
   ContentType$LWS[ContentType$LWS["SVG"] = 1] = "SVG";
-  ContentType$LWS[ContentType$LWS["XML"] = 2] = "XML";
+  ContentType$LWS[ContentType$LWS["XHTML"] = 2] = "XHTML";
+  ContentType$LWS[ContentType$LWS["XML"] = 3] = "XML";
 })(ContentType$LWS || (ContentType$LWS = {}));
 const evaluatedScripts$LWS = toSafeWeakSet$LWS$1(new WeakSetCtor$LWS$1());
 const scriptURLsCache$LWS = toSafeWeakMap$LWS$1(new WeakMapCtor$LWS$1());
@@ -4121,11 +4256,22 @@ const policyOptions$LWS = {
         }
       case ContentType$LWS.SVG:
         {
-          const tplElement$LWS = ReflectApply$LWS$1(DocumentProtoCreateElement$LWS$1, document, ['template']);
-          ReflectApply$LWS$1(ElementProtoInnerHTMLSetter$LWS, tplElement$LWS, [trusted.createHTML(dirty$LWS)]);
-          const wrappedDirty$LWS = ReflectApply$LWS$1(DocumentProtoCreateElementNS$LWS, document, [NAMESPACE_SVG$LWS, 'svg']);
-          ReflectApply$LWS$1(ElementProtoInnerHTMLSetter$LWS, wrappedDirty$LWS, [trusted.createHTML(dirty$LWS)]);
-          const sanitized$LWS = getSanitizerForConfig$LWS('SHARED_SVG_SANITIZER_KEY', 'NODE_SVG').sanitize(wrappedDirty$LWS);
+          let svgWrapper$LWS;
+          if (isGaterEnabledFeature$LWS('changesSince.262')) {
+            // Use template element to parse SVG content - template content is inert,
+            // meaning images won't load and event handlers won't fire during parsing.
+            // This prevents TOCTOU attacks where onload fires before sanitization.
+            const tplElement$LWS = ReflectApply$LWS$1(DocumentProtoCreateElement$LWS$1, document, ['template']);
+            // Wrap dirty content in SVG to ensure proper SVG namespace parsing
+            ReflectApply$LWS$1(ElementProtoInnerHTMLSetter$LWS, tplElement$LWS, [trusted.createHTML(`<svg xmlns="${NAMESPACE_SVG$LWS}">${dirty$LWS}</svg>`)]);
+            const content$LWS = ReflectApply$LWS$1(HTMLTemplateElementProtoContentGetter$LWS, tplElement$LWS, []);
+            svgWrapper$LWS = ReflectApply$LWS$1(NodeProtoFirstChildGetter$LWS, content$LWS, []);
+          } else {
+            // Original behavior: create live SVG element (vulnerable to TOCTOU)
+            svgWrapper$LWS = ReflectApply$LWS$1(DocumentProtoCreateElementNS$LWS, document, [NAMESPACE_SVG$LWS, 'svg']);
+            ReflectApply$LWS$1(ElementProtoInnerHTMLSetter$LWS, svgWrapper$LWS, [trusted.createHTML(dirty$LWS)]);
+          }
+          const sanitized$LWS = getSanitizerForConfig$LWS('SHARED_SVG_SANITIZER_KEY', 'NODE_SVG').sanitize(svgWrapper$LWS);
           const firstChild$LWS = ReflectApply$LWS$1(NodeProtoFirstChildGetter$LWS, sanitized$LWS, []);
           return ReflectApply$LWS$1(ElementProtoInnerHTMLGetter$LWS, firstChild$LWS, []);
         }
@@ -4239,7 +4385,7 @@ function createScriptSrcURLSetter$LWS(targetElement$LWS) {
     ReflectApply$LWS$1(ElementProtoSetAttributeNS$LWS, targetElement$LWS, [attributeNamespaceURI$LWS, attributeName$LWS, src$LWS]);
   };
 }
-/*! version: 0.26.4 */
+/*! version: 0.27.5 */
 
 /*!
  * Copyright (C) 2019 salesforce.com, inc.
@@ -4986,6 +5132,28 @@ function setCustomElementsRegistry$LWS(document$LWS, key$LWS) {
   currentRegistry$LWS = getSandboxCustomElementRegistry$LWS(document$LWS, key$LWS);
 }
 const DataTransferProtoBlockedProperties$LWS = ['mozCursor', 'mozSourceNode', 'mozUserCancelled'];
+
+/**
+ * Blocks read access to the 'nonce' attribute.
+ *
+ * The 'nonce' attribute contains a cryptographic token used by Content Security Policy
+ * to allow specific inline scripts/styles to execute. If malicious code can read this
+ * value, it can bypass CSP by injecting scripts with the stolen nonce.
+ *
+ * This function is intentionally separate from the general attribute distortion registry
+ * (registerAttributeDistortion/getAttributeDistortion) because that registry is designed
+ * for setter distortions that validate/sanitize values being set. Most blocked attributes
+ * (like 'srcdoc' on iframes) only need to block writes while allowing reads. The 'nonce'
+ * attribute is unique in that it must block both reads AND writes.
+ *
+ * By using a dedicated function, we avoid incorrectly applying setter distortions when
+ * reading attributes, which would cause errors for attributes like 'src' and 'href'.
+ */
+function blockAccessToNonce$LWS(attrName$LWS) {
+  if (attrName$LWS === 'nonce') {
+    throw new LockerSecurityError$LWS("Attribute 'nonce' not accessible");
+  }
+}
 const attributeDistortionFactoriesCache$LWS = toSafeMap$LWS$1(new MapCtor$LWS$1());
 const sandboxAttributeDistortionRegistryCache$LWS = toSafeWeakMap$LWS$1(new WeakMapCtor$LWS$1());
 function finalizeAttributeDistortions$LWS(record$LWS) {
@@ -5016,11 +5184,7 @@ function finalizeAttributeDistortions$LWS(record$LWS) {
     attributeFactories$LWS[i$LWS](attributeDistortionRegistry$LWS);
   }
 }
-function getAttributeDistortion$LWS(record$LWS, element$LWS, attrName$LWS, attributeNamespace$LWS = NAMESPACE_DEFAULT$LWS) {
-  const {
-    document: document$LWS,
-    key: key$LWS
-  } = record$LWS;
+function lookupAttributeDistortion$LWS(document$LWS, key$LWS, element$LWS, attrName$LWS, attributeNamespace$LWS) {
   const sandboxAttributeDistortionRegistry$LWS = sandboxAttributeDistortionRegistryCache$LWS.get(document$LWS);
   // istanbul ignore if: currently unreachable via tests
   if (sandboxAttributeDistortionRegistry$LWS === undefined) {
@@ -5052,6 +5216,29 @@ function getAttributeDistortion$LWS(record$LWS, element$LWS, attrName$LWS, attri
   }
   return undefined;
 }
+function getAttributeDistortion$LWS(record$LWS, element$LWS, attrName$LWS, attributeNamespace$LWS = NAMESPACE_DEFAULT$LWS) {
+  const {
+    document: document$LWS,
+    key: key$LWS
+  } = record$LWS;
+  const result$LWS = lookupAttributeDistortion$LWS(document$LWS, key$LWS, element$LWS, attrName$LWS, attributeNamespace$LWS);
+  if (result$LWS !== undefined) {
+    return result$LWS;
+  }
+  // When an element is passed to a setAttribute function from a different
+  // realm (e.g. cross-realm setAttribute obtained via a navigated iframe),
+  // the instanceof check fails because the registry's constructors belong
+  // to the function's realm, not the element's. Fall back to the element's
+  // ownerDocument registry where constructors match the element's prototype
+  // chain.
+  if (isGaterEnabledFeature$LWS('changesSince.262')) {
+    const elementDocument$LWS = ReflectApply$LWS$1(NodeProtoOwnerDocumentGetter$LWS, element$LWS, []);
+    if (elementDocument$LWS && elementDocument$LWS !== document$LWS) {
+      return lookupAttributeDistortion$LWS(elementDocument$LWS, key$LWS, element$LWS, attrName$LWS, attributeNamespace$LWS);
+    }
+  }
+  return undefined;
+}
 // Utility for normalizing namespaces which default to HTML behavior.
 // script.setAttributeNS(null, 'src', 'foo.js') has the same behavior as
 // script.setAttribute('src', 'foo.js').
@@ -5805,9 +5992,13 @@ function initDistortionDocumentCreateElement$LWS({
       const {
         0: tagName$LWS
       } = args$LWS;
+      const normalizedTagName$LWS = ReflectApply$LWS$1(StringProtoToLowerCase$LWS, tagName$LWS, []);
+      if (isGaterEnabledFeature$LWS('changesSince.262') && isBlockedElement$LWS(normalizedTagName$LWS)) {
+        throw new LockerSecurityError$LWS(`Cannot create '${normalizedTagName$LWS}' element.`);
+      }
       // Slow path for potential custom elements that might be registered
       // in the sandbox's virtual custom element registry.
-      if (ReflectApply$LWS$1(StringProtoIncludes$LWS, tagName$LWS, ['-'])) {
+      if (ReflectApply$LWS$1(StringProtoIncludes$LWS, normalizedTagName$LWS, ['-'])) {
         // This must be called to signal to the virtual
         // CustomElementRegistry that the next thing created will be
         // a custom element and it must be marked for association to
@@ -5835,17 +6026,71 @@ function initDistortionDocumentCreateElementNS$LWS({
       const {
         1: tagName$LWS
       } = args$LWS;
+      const normalizedTagName$LWS = ReflectApply$LWS$1(StringProtoToLowerCase$LWS, tagName$LWS, []);
+      if (isGaterEnabledFeature$LWS('changesSince.262') && isBlockedElement$LWS(normalizedTagName$LWS)) {
+        throw new LockerSecurityError$LWS(`Cannot create '${normalizedTagName$LWS}' element.`);
+      }
       // Slow path for potential custom elements that might
       // be registered in the sandbox's virtual custom element registry.
-      if (ReflectApply$LWS$1(StringProtoIncludes$LWS, tagName$LWS, ['-'])) {
+      if (ReflectApply$LWS$1(StringProtoIncludes$LWS, normalizedTagName$LWS, ['-'])) {
         // This must be called to signal to the virtual
         // CustomElementRegistry that the next thing created will be
         // a custom element and it must be marked for association to
         // this sandbox.
         setCustomElementsRegistry$LWS(document$LWS, key$LWS);
       }
-      return ReflectApply$LWS$1(originalDocumentCreateElementNS$LWS, this, args$LWS);
-    }];
+      return ReflectApply$LWS$1(originalDocumentCreateElementNS$LWS, this, args$LWS);
+    }];
+  };
+}
+const {
+  isSharedElement: isSharedElement$C$LWS
+} = rootValidator$LWS;
+function initDistortionDocumentCreateNodeIterator$LWS({
+  globalObject: {
+    Document: {
+      prototype: {
+        createNodeIterator: originalCreateNodeIterator$LWS
+      }
+    }
+  }
+}) {
+  const distortionEntry$LWS = [originalCreateNodeIterator$LWS, function createNodeIterator$LWS(...args$LWS) {
+    const {
+      0: root$LWS
+    } = args$LWS;
+    if (isGaterEnabledFeature$LWS('changesSince.262') && root$LWS && isSharedElement$C$LWS(root$LWS)) {
+      throw new LockerSecurityError$LWS(`Cannot create NodeIterator rooted at shared element ${ReflectApply$LWS$1(NodeProtoNodeNameGetter$LWS, root$LWS, [])}.`);
+    }
+    return ReflectApply$LWS$1(originalCreateNodeIterator$LWS, this, args$LWS);
+  }];
+  return function distortionDocumentCreateNodeIterator$LWS() {
+    return distortionEntry$LWS;
+  };
+}
+const {
+  isSharedElement: isSharedElement$B$LWS
+} = rootValidator$LWS;
+function initDistortionDocumentCreateTreeWalker$LWS({
+  globalObject: {
+    Document: {
+      prototype: {
+        createTreeWalker: originalCreateTreeWalker$LWS
+      }
+    }
+  }
+}) {
+  const distortionEntry$LWS = [originalCreateTreeWalker$LWS, function createTreeWalker$LWS(...args$LWS) {
+    const {
+      0: root$LWS
+    } = args$LWS;
+    if (isGaterEnabledFeature$LWS('changesSince.262') && root$LWS && isSharedElement$B$LWS(root$LWS)) {
+      throw new LockerSecurityError$LWS(`Cannot create TreeWalker rooted at shared element ${ReflectApply$LWS$1(NodeProtoNodeNameGetter$LWS, root$LWS, [])}.`);
+    }
+    return ReflectApply$LWS$1(originalCreateTreeWalker$LWS, this, args$LWS);
+  }];
+  return function distortionDocumentCreateTreeWalker$LWS() {
+    return distortionEntry$LWS;
   };
 }
 function domain$LWS() {
@@ -5863,8 +6108,13 @@ function initDistortionDocumentDomainSetter$LWS({
   };
 }
 const {
-  isSharedElement: isSharedElement$s$LWS
+  isSharedElement: isSharedElement$A$LWS
 } = rootValidator$LWS;
+// Regex to strip non-ASCII characters after NFKD normalization.
+// This handles Unicode normalization attacks like using Turkish "İ" (U+0130)
+// which Firefox normalizes to "I" in execCommand, bypassing lowercase checks.
+// eslint-disable-next-line no-control-regex
+const nonASCIIRegExp$LWS = /[^\x00-\x7F]/g;
 function throwLockerSecurityError$LWS(command$LWS, target$LWS) {
   throw new LockerSecurityError$LWS(`Cannot execute command '${command$LWS}' on ${ReflectApply$LWS$1(NodeProtoNodeNameGetter$LWS, target$LWS, [])}.`);
 }
@@ -5891,7 +6141,20 @@ function initDistortionDocumentExecCommand$LWS({
       } = args$LWS;
       if (length$LWS >= 1) {
         const command$LWS = toSafeStringValue$LWS(args$LWS[0]);
-        const loweredCommand$LWS = ReflectApply$LWS$1(StringProtoToLowerCase$LWS, command$LWS, []);
+        let loweredCommand$LWS;
+        // istanbul ignore else: ungated else is not reachable in coverage runs
+        if (isGaterEnabledFeature$LWS('changesSince.262')) {
+          // Normalize the command using NFKD (Compatibility Decomposition)
+          // to handle Unicode normalization attacks. For example, Turkish "İ"
+          // (U+0130) decomposes to "I" + combining dot above, and we then
+          // strip non-ASCII characters to get a clean ASCII string for comparison.
+          // This matches Firefox's internal behavior which normalizes commands.
+          const normalizedCommand$LWS = ReflectApply$LWS$1(StringProtoNormalize$LWS, command$LWS, ['NFKD']);
+          const asciiOnlyCommand$LWS = ReflectApply$LWS$1(StringProtoReplace$LWS, normalizedCommand$LWS, [nonASCIIRegExp$LWS, '']);
+          loweredCommand$LWS = ReflectApply$LWS$1(StringProtoToLowerCase$LWS, asciiOnlyCommand$LWS, []);
+        } else {
+          loweredCommand$LWS = ReflectApply$LWS$1(StringProtoToLowerCase$LWS, command$LWS, []);
+        }
         if (loweredCommand$LWS === 'selectall' && this === rootDocument$LWS) {
           throwLockerSecurityError$LWS(command$LWS, this);
         }
@@ -5909,7 +6172,7 @@ function initDistortionDocumentExecCommand$LWS({
               // istanbul ignore else: external is the default sandbox type for coverage runs
               if (type$LWS === 0 /* SandboxType.External */) {
                 const activeElement$LWS = ReflectApply$LWS$1(originalActiveElement$LWS, this, []);
-                if (isSharedElement$s$LWS(activeElement$LWS) && ReflectApply$LWS$1(originalIsContentEditable$LWS, activeElement$LWS, [])) {
+                if (isSharedElement$A$LWS(activeElement$LWS) && ReflectApply$LWS$1(originalIsContentEditable$LWS, activeElement$LWS, [])) {
                   throwLockerSecurityError$LWS(command$LWS, activeElement$LWS);
                 }
               }
@@ -5961,25 +6224,23 @@ function initDistortionDocumentOpen$LWS({
       // for window.open
       // https://developer.mozilla.org/en-US/docs/Web/API/Document/open#three-argument_document.open
       const normalizedArgs$LWS = normalizeWindowOpenArguments$LWS(args$LWS);
-      const childWindow$LWS = ReflectApply$LWS$1(originalDocumentOpen$LWS, this, normalizedArgs$LWS);
+      // istanbul ignore next: resourceUrl default is not reachable via tests
       const {
         0: resourceUrl$LWS = ''
       } = normalizedArgs$LWS;
-      // In 256, limit this restriction to urls that can be treated as same-origin
-      // istanbul ignore else: previous behavior will not be tested in collection coverage
-      if (isGaterEnabledFeature$LWS('changesSince.256')) {
-        // This CANNOT be combined with the above condition, because doing so
-        // will result in the else consequent body being executed in the case
-        // where the gate is enabled and the url is not same origin,
-        // which is counter to the goals of this change!!
-        if (isSameOriginURL$LWS(resourceUrl$LWS)) {
-          // W-16032332
-          // Block access to unsafe child window properties
+      if (isGaterEnabledFeature$LWS('changesSince.262') && isAttemptingToExploitURL$LWS(resourceUrl$LWS)) {
+        throw new LockerSecurityError$LWS(`Cannot open: ${resourceUrl$LWS}`);
+      }
+      const childWindow$LWS = ReflectApply$LWS$1(originalDocumentOpen$LWS, this, normalizedArgs$LWS);
+      if (!isGaterEnabledFeature$LWS('changesSince.262')) {
+        // istanbul ignore else: previous behavior will not be tested in collection coverage
+        if (isGaterEnabledFeature$LWS('changesSince.256')) {
+          if (isSameOriginURL$LWS(resourceUrl$LWS)) {
+            markForUnsafePropertyBlocking$LWS(childWindow$LWS);
+          }
+        } else {
           markForUnsafePropertyBlocking$LWS(childWindow$LWS);
         }
-      } else {
-        // When the gate is disabled, mark all child windows
-        markForUnsafePropertyBlocking$LWS(childWindow$LWS);
       }
       if (childWindow$LWS) {
         initWindowOpenChildWindow$LWS(childWindow$LWS, resourceUrl$LWS);
@@ -6029,7 +6290,9 @@ function initDistortionDOMParserParseFromString$LWS({
   }) {
     return [originalParseFromString$LWS, function parseFromString$LWS(...args$LWS) {
       const {
-        isInherentlyUnsecure: isInherentlyUnsecure$LWS
+        isIframeSrcdocScriptAttack: isIframeSrcdocScriptAttack$LWS,
+        isXMLEntityAttack: isXMLEntityAttack$LWS,
+        isXMLNamespacedScriptAttack: isXMLNamespacedScriptAttack$LWS
       } = getValidator$LWS(document$LWS, globalObject$LWS);
       // DOMParser.prototype.parseFromString can only be called with
       // exactly two arguments. If it receives one argument, it will fail.
@@ -6045,8 +6308,12 @@ function initDistortionDOMParserParseFromString$LWS({
         let contentType$LWS;
         switch (mimeType$LWS) {
           case 'application/xhtml+xml':
+            // XHTML is HTML in XML syntax - sanitize as HTML
+            contentType$LWS = ContentType$LWS.XHTML;
+            break;
           case 'application/xml':
           case 'text/xml':
+            // Generic XML is not sanitized (may contain non-HTML tags)
             contentType$LWS = ContentType$LWS.XML;
             break;
           case 'image/svg+xml':
@@ -6055,17 +6322,19 @@ function initDistortionDOMParserParseFromString$LWS({
           default:
             contentType$LWS = ContentType$LWS.HTML;
         }
+        // For XML/XHTML types, check for iframe/script attacks BEFORE sanitization.
+        // This ensures we throw on dangerous content rather than silently removing it.
+        if (isGaterEnabledFeature$LWS('changesSince.262') && (contentType$LWS === ContentType$LWS.XML || contentType$LWS === ContentType$LWS.XHTML)) {
+          if (isIframeSrcdocScriptAttack$LWS(string$LWS) || isXMLEntityAttack$LWS(string$LWS) || isXMLNamespacedScriptAttack$LWS(string$LWS)) {
+            throw new LockerSecurityError$LWS(`Cannot 'parseFromString' using an unsecure ${toSafeTemplateStringValue$LWS(string$LWS)}.`);
+          }
+        }
         // This must be called to signal to the virtual
         // CustomElementRegistry that the next thing created
         // MAY CONTAIN a custom element, which must be marked for
         // association to this sandbox.
         setCustomElementsRegistry$LWS(document$LWS, key$LWS);
         const trustedHtml$LWS = lwsInternalPolicy$LWS.createHTML(string$LWS, key$LWS, contentType$LWS);
-        if (contentType$LWS === ContentType$LWS.XML) {
-          if (isInherentlyUnsecure$LWS(trustedHtml$LWS)) {
-            throw new LockerSecurityError$LWS(`Cannot 'parseFromString' using an unsecure ${toSafeTemplateStringValue$LWS(trustedHtml$LWS)}.`);
-          }
-        }
         // Reassign args with sanitized string
         args$LWS[0] = trustedHtml$LWS;
         // Prevent shapeshifting arg from manipulating the
@@ -6077,7 +6346,7 @@ function initDistortionDOMParserParseFromString$LWS({
   };
 }
 const {
-  isSharedElement: isSharedElement$r$LWS,
+  isSharedElement: isSharedElement$z$LWS,
   isAllowedSharedElementChild: isAllowedSharedElementChild$6$LWS
 } = rootValidator$LWS;
 function initDistortionElementAfter$LWS({
@@ -6092,7 +6361,7 @@ function initDistortionElementAfter$LWS({
 }) {
   const distortionEntry$LWS = [originalAfter$LWS, function after$LWS(...args$LWS) {
     // istanbul ignore else: needs default platform behavior test
-    if (isSharedElement$r$LWS(this)) {
+    if (isSharedElement$z$LWS(this)) {
       for (let i$LWS = 0, {
           length: length$LWS
         } = args$LWS; i$LWS < length$LWS; i$LWS += 1) {
@@ -6110,7 +6379,7 @@ function initDistortionElementAfter$LWS({
   };
 }
 const {
-  isSharedElement: isSharedElement$q$LWS,
+  isSharedElement: isSharedElement$y$LWS,
   isAllowedSharedElementChild: isAllowedSharedElementChild$5$LWS
 } = rootValidator$LWS;
 function initDistortionElementAppend$LWS({
@@ -6125,7 +6394,7 @@ function initDistortionElementAppend$LWS({
 }) {
   const distortionEntry$LWS = [originalAppend$LWS, function append$LWS(...args$LWS) {
     // istanbul ignore else: needs default platform behavior test
-    if (isSharedElement$q$LWS(this)) {
+    if (isSharedElement$y$LWS(this)) {
       // Element.prototype.append(...args) accepts an arbitrary number
       // of arguments which can be comprised of Nodes and DOMStrings.
       for (let i$LWS = 0, {
@@ -6222,7 +6491,7 @@ function initDistortionElementAttributesGetter$LWS({
   };
 }
 const {
-  isSharedElement: isSharedElement$p$LWS,
+  isSharedElement: isSharedElement$x$LWS,
   isAllowedSharedElementChild: isAllowedSharedElementChild$4$LWS
 } = rootValidator$LWS;
 function initDistortionElementBefore$LWS({
@@ -6237,7 +6506,7 @@ function initDistortionElementBefore$LWS({
 }) {
   const distortionEntry$LWS = [originalBefore$LWS, function before$LWS(...args$LWS) {
     // istanbul ignore else: needs default platform behavior test
-    if (isSharedElement$p$LWS(this)) {
+    if (isSharedElement$x$LWS(this)) {
       for (let i$LWS = 0, {
           length: length$LWS
         } = args$LWS; i$LWS < length$LWS; i$LWS += 1) {
@@ -6255,6 +6524,90 @@ function initDistortionElementBefore$LWS({
     return distortionEntry$LWS;
   };
 }
+function initDistortionElementGetAttribute$LWS({
+  globalObject: {
+    Element: {
+      prototype: {
+        getAttribute: originalGetAttribute$LWS
+      }
+    }
+  }
+}) {
+  return function distortionElementGetAttribute$LWS() {
+    return [originalGetAttribute$LWS, function getAttribute$LWS(...args$LWS) {
+      const {
+        length: length$LWS
+      } = args$LWS;
+      if (isGaterEnabledFeature$LWS('changesSince.262') && length$LWS > 0) {
+        blockAccessToNonce$LWS(normalizeNamespacedAttributeName$LWS(toSafeStringValue$LWS(args$LWS[0])));
+      }
+      return ReflectApply$LWS$1(originalGetAttribute$LWS, this, args$LWS);
+    }];
+  };
+}
+function initDistortionElementGetAttributeNode$LWS({
+  globalObject: {
+    Element: {
+      prototype: {
+        getAttributeNode: originalGetAttributeNode$LWS
+      }
+    }
+  }
+}) {
+  return function distortionElementGetAttributeNode$LWS() {
+    return [originalGetAttributeNode$LWS, function getAttributeNode$LWS(...args$LWS) {
+      const {
+        length: length$LWS
+      } = args$LWS;
+      if (isGaterEnabledFeature$LWS('changesSince.262') && length$LWS > 0) {
+        blockAccessToNonce$LWS(normalizeNamespacedAttributeName$LWS(toSafeStringValue$LWS(args$LWS[0])));
+      }
+      return ReflectApply$LWS$1(originalGetAttributeNode$LWS, this, args$LWS);
+    }];
+  };
+}
+function initDistortionElementGetAttributeNodeNS$LWS({
+  globalObject: {
+    Element: {
+      prototype: {
+        getAttributeNodeNS: originalGetAttributeNodeNS$LWS
+      }
+    }
+  }
+}) {
+  return function distortionElementGetAttributeNodeNS$LWS() {
+    return [originalGetAttributeNodeNS$LWS, function getAttributeNodeNS$LWS(...args$LWS) {
+      const {
+        length: length$LWS
+      } = args$LWS;
+      if (isGaterEnabledFeature$LWS('changesSince.262') && length$LWS >= 2) {
+        blockAccessToNonce$LWS(normalizeNamespacedAttributeName$LWS(toSafeStringValue$LWS(args$LWS[1])));
+      }
+      return ReflectApply$LWS$1(originalGetAttributeNodeNS$LWS, this, args$LWS);
+    }];
+  };
+}
+function initDistortionElementGetAttributeNS$LWS({
+  globalObject: {
+    Element: {
+      prototype: {
+        getAttributeNS: originalGetAttributeNS$LWS
+      }
+    }
+  }
+}) {
+  return function distortionElementGetAttributeNS$LWS() {
+    return [originalGetAttributeNS$LWS, function getAttributeNS$LWS(...args$LWS) {
+      const {
+        length: length$LWS
+      } = args$LWS;
+      if (isGaterEnabledFeature$LWS('changesSince.262') && length$LWS >= 2) {
+        blockAccessToNonce$LWS(normalizeNamespacedAttributeName$LWS(toSafeStringValue$LWS(args$LWS[1])));
+      }
+      return ReflectApply$LWS$1(originalGetAttributeNS$LWS, this, args$LWS);
+    }];
+  };
+}
 
 // TODO: this has been deprecated and is no longer implemented in any browser
 function initDistortionElementGetInnerHTML$LWS({
@@ -6301,6 +6654,28 @@ function initDistortionElementGetInnerHTML$LWS({
     return distortionEntry$LWS;
   };
 }
+function initDistortionElementInnerHTMLGetter$LWS({
+  globalObject: globalObject$LWS
+}) {
+  const {
+    Element: Element$LWS
+  } = globalObject$LWS;
+  const originalInnerHTMLGetter$LWS = ObjectLookupOwnGetter$LWS$1(Element$LWS.prototype, 'innerHTML');
+  const distortionEntry$LWS = [originalInnerHTMLGetter$LWS, function innerHTML$LWS() {
+    if (isGaterEnabledFeature$LWS('changesSince.262')) {
+      var _getOriginalScriptPro$LWS;
+      if (isUnknownScriptElement$LWS(this, globalObject$LWS)) {
+        return '';
+      }
+      return (_getOriginalScriptPro$LWS = getOriginalScriptProperty$LWS(this)) != null ? _getOriginalScriptPro$LWS : removeNoncePatterns$LWS(ReflectApply$LWS$1(originalInnerHTMLGetter$LWS, this, []));
+    }
+    // istanbul ignore next: ungated return is not reachable in coverage runs
+    return ReflectApply$LWS$1(originalInnerHTMLGetter$LWS, this, []);
+  }];
+  return function distortionElementInnerHTMLGetter$LWS() {
+    return distortionEntry$LWS;
+  };
+}
 function scriptPropertySetters$LWS(incomingThis$LWS, property$LWS, valueAsTrustedString$LWS, originalScriptPropertyGetter$LWS, originalScriptPropertySetter$LWS, distortions$LWS, sandboxEvaluator$LWS, signedScriptHookSourceText$LWS) {
   const valueAsString$LWS = toSafeStringValue$LWS(valueAsTrustedString$LWS);
   if (!isScriptPropertyEvaluatorHookDefined$LWS(incomingThis$LWS)) {
@@ -6332,8 +6707,8 @@ function scriptPropertySetters$LWS(incomingThis$LWS, property$LWS, valueAsTruste
   return false;
 }
 const {
-  isInherentlyUnsecure: isInherentlyUnsecure$4$LWS,
-  isSharedElement: isSharedElement$o$LWS
+  isIframeSrcdocScriptAttack: isIframeSrcdocScriptAttack$5$LWS,
+  isSharedElement: isSharedElement$w$LWS
 } = rootValidator$LWS;
 function initDistortionElementInnerHTMLSetter$LWS({
   document: document$LWS,
@@ -6357,9 +6732,15 @@ function initDistortionElementInnerHTMLSetter$LWS({
   }) {
     return [originalInnerHTMLSetter$LWS, function innerHTML$LWS(value$LWS) {
       const isOwnerXMLDocument$LWS = ReflectApply$LWS$1(NodeProtoOwnerDocumentGetter$LWS, this, []) instanceof XMLDocument$LWS;
-      if (!isOwnerXMLDocument$LWS) {
+      // SVG elements can contain executable event handlers (onload, onerror, etc.)
+      // even when inside an XMLDocument, so they must always be sanitized.
+      const isSVGElement$LWS = isGaterEnabledFeature$LWS('changesSince.262') && this instanceof SVGElement$LWS;
+      // Sanitize if:
+      // 1. Not an XMLDocument (existing behavior for HTML documents), OR
+      // 2. It's an SVGElement (SVG elements can have event handlers even in XMLDocuments)
+      if (!isOwnerXMLDocument$LWS || isSVGElement$LWS) {
         // istanbul ignore else: needs default platform behavior test
-        if (isSharedElement$o$LWS(this)) {
+        if (isSharedElement$w$LWS(this)) {
           throw new LockerSecurityError$LWS(`Cannot set innerHTML of ${ReflectApply$LWS$1(NodeProtoNodeNameGetter$LWS, this, [])}.`);
         }
         if (this instanceof HTMLScriptElement$LWS || this instanceof SVGScriptElement) {
@@ -6373,10 +6754,10 @@ function initDistortionElementInnerHTMLSetter$LWS({
         // MAY CONTAIN a custom element, which must be marked for
         // association to this sandbox.
         setCustomElementsRegistry$LWS(document$LWS, key$LWS);
-        const contentType$LWS = this instanceof SVGElement$LWS ? ContentType$LWS.SVG : ContentType$LWS.HTML;
+        const contentType$LWS = isSVGElement$LWS ? ContentType$LWS.SVG : ContentType$LWS.HTML;
         value$LWS = lwsInternalPolicy$LWS.createHTML(value$LWS, key$LWS, contentType$LWS);
       }
-      if (isInherentlyUnsecure$4$LWS(value$LWS)) {
+      if (isIframeSrcdocScriptAttack$5$LWS(value$LWS)) {
         throw new LockerSecurityError$LWS(`Cannot set 'innerHTML' using an unsecure ${toSafeTemplateStringValue$LWS(value$LWS)}.`);
       }
       ReflectApply$LWS$1(originalInnerHTMLSetter$LWS, this, [value$LWS]);
@@ -6384,7 +6765,7 @@ function initDistortionElementInnerHTMLSetter$LWS({
   };
 }
 const {
-  isSharedElement: isSharedElement$n$LWS,
+  isSharedElement: isSharedElement$v$LWS,
   isAllowedSharedElementChild: isAllowedSharedElementChild$3$LWS
 } = rootValidator$LWS;
 function initDistortionElementInsertAdjacentElement$LWS({
@@ -6403,7 +6784,7 @@ function initDistortionElementInsertAdjacentElement$LWS({
         1: element$LWS
       } = args$LWS;
       // istanbul ignore else: needs default platform behavior test
-      if (isSharedElement$n$LWS(this) && !isAllowedSharedElementChild$3$LWS(element$LWS)) {
+      if (isSharedElement$v$LWS(this) && !isAllowedSharedElementChild$3$LWS(element$LWS)) {
         throw new LockerSecurityError$LWS(`Cannot insert ${ReflectApply$LWS$1(NodeProtoNodeNameGetter$LWS, element$LWS, [])} adjacent to ${ReflectApply$LWS$1(NodeProtoNodeNameGetter$LWS, this, [])}.`);
       }
     }
@@ -6414,8 +6795,8 @@ function initDistortionElementInsertAdjacentElement$LWS({
   };
 }
 const {
-  isInherentlyUnsecure: isInherentlyUnsecure$3$LWS,
-  isSharedElement: isSharedElement$m$LWS
+  isIframeSrcdocScriptAttack: isIframeSrcdocScriptAttack$4$LWS,
+  isSharedElement: isSharedElement$u$LWS
 } = rootValidator$LWS;
 const allowedElementHTMLRegExp$LWS = /^\s*<(link|script|style)/i;
 function initDistortionElementInsertAdjacentHTML$LWS({
@@ -6435,7 +6816,7 @@ function initDistortionElementInsertAdjacentHTML$LWS({
       // istanbul ignore else: needs default platform behavior test
       if (args$LWS.length > 1) {
         const match$LWS = ReflectApply$LWS$1(StringProtoMatch$LWS, args$LWS[1], [allowedElementHTMLRegExp$LWS]);
-        if (isSharedElement$m$LWS(this) && match$LWS === null) {
+        if (isSharedElement$u$LWS(this) && match$LWS === null) {
           throw new LockerSecurityError$LWS(`Cannot insert adjacent HTML to ${ReflectApply$LWS$1(NodeProtoNodeNameGetter$LWS, this, [])}`);
         }
         // This must be called to signal to the virtual
@@ -6446,7 +6827,7 @@ function initDistortionElementInsertAdjacentHTML$LWS({
         const contentType$LWS = this instanceof SVGElement ? ContentType$LWS.SVG : ContentType$LWS.HTML;
         args$LWS[1] = lwsInternalPolicy$LWS.createHTML(args$LWS[1], key$LWS, contentType$LWS);
         // If the sanitized string is still insecure, throw an exception
-        if (isInherentlyUnsecure$3$LWS(args$LWS[1])) {
+        if (isIframeSrcdocScriptAttack$4$LWS(args$LWS[1])) {
           throw new LockerSecurityError$LWS(`Cannot set 'insertAdjacentHTML' using an unsecure ${toSafeTemplateStringValue$LWS(args$LWS[1])}.`);
         }
       }
@@ -6454,9 +6835,27 @@ function initDistortionElementInsertAdjacentHTML$LWS({
     }];
   };
 }
+function initDistortionElementOuterHTMLGetter$LWS({
+  globalObject: {
+    Element: Element$LWS
+  }
+}) {
+  const originalOuterHTMLGetter$LWS = ObjectLookupOwnGetter$LWS$1(Element$LWS.prototype, 'outerHTML');
+  const distortionEntry$LWS = [originalOuterHTMLGetter$LWS, function outerHTML$LWS() {
+    const html$LWS = ReflectApply$LWS$1(originalOuterHTMLGetter$LWS, this, []);
+    if (isGaterEnabledFeature$LWS('changesSince.262')) {
+      return removeNoncePatterns$LWS(html$LWS);
+    }
+    // istanbul ignore next: ungated return is not reachable in coverage runs
+    return html$LWS;
+  }];
+  return function distortionElementOuterHTMLGetter$LWS() {
+    return distortionEntry$LWS;
+  };
+}
 const {
-  isInherentlyUnsecure: isInherentlyUnsecure$2$LWS,
-  isSharedElement: isSharedElement$l$LWS
+  isIframeSrcdocScriptAttack: isIframeSrcdocScriptAttack$3$LWS,
+  isSharedElement: isSharedElement$t$LWS
 } = rootValidator$LWS;
 function initDistortionElementOuterHTMLSetter$LWS({
   document: document$LWS,
@@ -6470,7 +6869,7 @@ function initDistortionElementOuterHTMLSetter$LWS({
   }) {
     return [originalOuterHTMLSetter$LWS, function outerHTML$LWS(value$LWS) {
       // istanbul ignore else: needs default platform behavior test
-      if (isSharedElement$l$LWS(this)) {
+      if (isSharedElement$t$LWS(this)) {
         throw new LockerSecurityError$LWS(`Cannot set outerHTML of ${ReflectApply$LWS$1(NodeProtoNodeNameGetter$LWS, this, [])}.`);
       }
       // This must be called to signal to the virtual
@@ -6481,7 +6880,7 @@ function initDistortionElementOuterHTMLSetter$LWS({
       const html$LWS = lwsInternalPolicy$LWS.createHTML(value$LWS, key$LWS, ContentType$LWS.HTML);
       // Ensure that the created html snippet is secure (no mXSS)
       if (isGaterEnabledFeature$LWS('changesSince.260')) {
-        if (isInherentlyUnsecure$2$LWS(html$LWS)) {
+        if (isIframeSrcdocScriptAttack$3$LWS(html$LWS)) {
           throw new LockerSecurityError$LWS(`Cannot set 'outerHTML' using an unsecure ${toSafeTemplateStringValue$LWS(value$LWS)}.`);
         }
       }
@@ -6490,7 +6889,7 @@ function initDistortionElementOuterHTMLSetter$LWS({
   };
 }
 const {
-  isSharedElement: isSharedElement$k$LWS,
+  isSharedElement: isSharedElement$s$LWS,
   isAllowedSharedElementChild: isAllowedSharedElementChild$2$LWS
 } = rootValidator$LWS;
 function initDistortionElementPrepend$LWS({
@@ -6505,7 +6904,7 @@ function initDistortionElementPrepend$LWS({
 }) {
   const distortionEntry$LWS = [originalPrepend$LWS, function prepend$LWS(...args$LWS) {
     // istanbul ignore else: needs default platform behavior test
-    if (isSharedElement$k$LWS(this)) {
+    if (isSharedElement$s$LWS(this)) {
       // Element.prototype.prepend(...args) accepts an arbitrary
       // number of arguments which can be comprised of Nodes and
       // DOMStrings.
@@ -6529,7 +6928,7 @@ function initDistortionElementPrepend$LWS({
   };
 }
 const {
-  isSharedElement: isSharedElement$j$LWS
+  isSharedElement: isSharedElement$r$LWS
 } = rootValidator$LWS;
 function initDistortionElementRemove$LWS({
   globalObject: {
@@ -6542,7 +6941,7 @@ function initDistortionElementRemove$LWS({
 }) {
   const distortionEntry$LWS = [originalRemove$LWS, function remove$LWS() {
     // istanbul ignore else: needs default platform behavior test
-    if (isSharedElement$j$LWS(this)) {
+    if (isSharedElement$r$LWS(this)) {
       throw new LockerSecurityError$LWS(`Cannot remove ${ReflectApply$LWS$1(NodeProtoNodeNameGetter$LWS, this, [])}.`);
     }
     ReflectApply$LWS$1(originalRemove$LWS, this, []);
@@ -6552,7 +6951,7 @@ function initDistortionElementRemove$LWS({
   };
 }
 const {
-  isSharedElement: isSharedElement$i$LWS
+  isSharedElement: isSharedElement$q$LWS
 } = rootValidator$LWS;
 function initDistortionElementReplaceChildren$LWS({
   globalObject: {
@@ -6565,7 +6964,7 @@ function initDistortionElementReplaceChildren$LWS({
 }) {
   const distortionEntry$LWS = [originalReplaceChildren$LWS, function replaceChildren$LWS(...args$LWS) {
     // istanbul ignore else: needs default platform behavior test
-    if (isSharedElement$i$LWS(this)) {
+    if (isSharedElement$q$LWS(this)) {
       throw new LockerSecurityError$LWS(`Cannot replace children of ${ReflectApply$LWS$1(NodeProtoNodeNameGetter$LWS, this, [])}.`);
     }
     return ReflectApply$LWS$1(originalReplaceChildren$LWS, this, args$LWS);
@@ -6575,7 +6974,7 @@ function initDistortionElementReplaceChildren$LWS({
   };
 }
 const {
-  isSharedElement: isSharedElement$h$LWS
+  isSharedElement: isSharedElement$p$LWS
 } = rootValidator$LWS;
 function initDistortionElementReplaceWith$LWS({
   globalObject: {
@@ -6588,7 +6987,7 @@ function initDistortionElementReplaceWith$LWS({
 }) {
   const distortionEntry$LWS = [originalReplaceWith$LWS, function replaceWith$LWS(...args$LWS) {
     // istanbul ignore else: needs default platform behavior test
-    if (isSharedElement$h$LWS(this)) {
+    if (isSharedElement$p$LWS(this)) {
       throw new LockerSecurityError$LWS(`Cannot replace ${ReflectApply$LWS$1(NodeProtoNodeNameGetter$LWS, this, [])}.`);
     }
     return ReflectApply$LWS$1(originalReplaceWith$LWS, this, args$LWS);
@@ -6794,8 +7193,8 @@ function initDistortionElementSetAttributeNS$LWS({
   };
 }
 const {
-  isInherentlyUnsecure: isInherentlyUnsecure$1$LWS,
-  isSharedElement: isSharedElement$g$LWS
+  isIframeSrcdocScriptAttack: isIframeSrcdocScriptAttack$2$LWS,
+  isSharedElement: isSharedElement$o$LWS
 } = rootValidator$LWS;
 function initDistortionElementSetHTML$LWS({
   document: document$LWS,
@@ -6819,10 +7218,16 @@ function initDistortionElementSetHTML$LWS({
   }) {
     return [originalSetHTML$LWS, function setHTML$LWS(...args$LWS) {
       const isOwnerXMLDocument$LWS = ReflectApply$LWS$1(NodeProtoOwnerDocumentGetter$LWS, this, []) instanceof XMLDocument$LWS;
-      if (!isOwnerXMLDocument$LWS) {
+      // SVG elements can contain executable event handlers (onload, onerror, etc.)
+      // even when inside an XMLDocument, so they must always be sanitized.
+      const isSVGElement$LWS = isGaterEnabledFeature$LWS('changesSince.262') && this instanceof SVGElement$LWS;
+      // Sanitize if:
+      // 1. Not an XMLDocument (existing behavior for HTML documents), OR
+      // 2. It's an SVGElement (SVG elements can have event handlers even in XMLDocuments)
+      if (!isOwnerXMLDocument$LWS || isSVGElement$LWS) {
         const normalizedValue$LWS = toSafeStringValue$LWS(args$LWS[0]);
         // istanbul ignore else: needs default platform behavior test
-        if (isSharedElement$g$LWS(this)) {
+        if (isSharedElement$o$LWS(this)) {
           throw new LockerSecurityError$LWS(`Cannot setHTML of ${ReflectApply$LWS$1(NodeProtoNodeNameGetter$LWS, this, [])}.`);
         }
         // This must be called to signal to the virtual
@@ -6832,9 +7237,9 @@ function initDistortionElementSetHTML$LWS({
         setCustomElementsRegistry$LWS(document$LWS, key$LWS);
         // If options not specified, the default Sanitizer object is used.
         // This will be in addition to the sanitization we have.
-        const contentType$LWS = this instanceof SVGElement$LWS ? ContentType$LWS.SVG : ContentType$LWS.HTML;
+        const contentType$LWS = isSVGElement$LWS ? ContentType$LWS.SVG : ContentType$LWS.HTML;
         args$LWS[0] = lwsInternalPolicy$LWS.createHTML(normalizedValue$LWS, key$LWS, contentType$LWS);
-        if (isInherentlyUnsecure$1$LWS(args$LWS[0])) {
+        if (isIframeSrcdocScriptAttack$2$LWS(args$LWS[0])) {
           throw new LockerSecurityError$LWS(`Cannot 'setHTML' using an unsecure ${toSafeTemplateStringValue$LWS(args$LWS[0])}.`);
         }
       }
@@ -6843,8 +7248,8 @@ function initDistortionElementSetHTML$LWS({
   };
 }
 const {
-  isInherentlyUnsecure: isInherentlyUnsecure$LWS,
-  isSharedElement: isSharedElement$f$LWS
+  isIframeSrcdocScriptAttack: isIframeSrcdocScriptAttack$1$LWS,
+  isSharedElement: isSharedElement$n$LWS
 } = rootValidator$LWS;
 function initDistortionElementSetHTMLUnsafe$LWS({
   document: document$LWS,
@@ -6878,9 +7283,15 @@ function initDistortionElementSetHTMLUnsafe$LWS({
     return [originalSetHTMLUnsafe$LWS, function setHTMLUnsafe$LWS(value$LWS) {
       let normalizedValue$LWS = toSafeStringValue$LWS(value$LWS);
       const isOwnerXMLDocument$LWS = ReflectApply$LWS$1(NodeProtoOwnerDocumentGetter$LWS, this, []) instanceof XMLDocument$LWS;
-      if (!isOwnerXMLDocument$LWS) {
+      // SVG elements can contain executable event handlers (onload, onerror, etc.)
+      // even when inside an XMLDocument, so they must always be sanitized.
+      const isSVGElement$LWS = isGaterEnabledFeature$LWS('changesSince.262') && this instanceof SVGElement$LWS;
+      // Sanitize if:
+      // 1. Not an XMLDocument (existing behavior for HTML documents), OR
+      // 2. It's an SVGElement (SVG elements can have event handlers even in XMLDocuments)
+      if (!isOwnerXMLDocument$LWS || isSVGElement$LWS) {
         // istanbul ignore else: needs default platform behavior test
-        if (isSharedElement$f$LWS(this)) {
+        if (isSharedElement$n$LWS(this)) {
           throw new LockerSecurityError$LWS(`Cannot 'setHTMLUnsafe' of ${ReflectApply$LWS$1(NodeProtoNodeNameGetter$LWS, this, [])}.`);
         }
         // This is necessary to support script.setHTMLUnsafe(...)
@@ -6895,10 +7306,10 @@ function initDistortionElementSetHTMLUnsafe$LWS({
         // MAY CONTAIN a custom element, which must be marked for
         // association to this sandbox.
         setCustomElementsRegistry$LWS(document$LWS, key$LWS);
-        const contentType$LWS = this instanceof SVGElement$LWS ? ContentType$LWS.SVG : ContentType$LWS.HTML;
+        const contentType$LWS = isSVGElement$LWS ? ContentType$LWS.SVG : ContentType$LWS.HTML;
         normalizedValue$LWS = lwsInternalPolicy$LWS.createHTML(normalizedValue$LWS, key$LWS, contentType$LWS);
       }
-      if (isInherentlyUnsecure$LWS(normalizedValue$LWS)) {
+      if (isIframeSrcdocScriptAttack$1$LWS(normalizedValue$LWS)) {
         throw new LockerSecurityError$LWS(`Cannot 'setHTMLUnsafe' using an unsecure ${toSafeTemplateStringValue$LWS(normalizedValue$LWS)}.`);
       }
       ReflectApply$LWS$1(originalSetHTMLUnsafe$LWS, this, [normalizedValue$LWS]);
@@ -6976,7 +7387,9 @@ function initDistortionEval$LWS({
     virtualEnvironmentEvaluator: virtualEnvironmentEvaluator$LWS
   }) {
     return [originalEval$LWS, function (sourceText$LWS) {
-      throwIfMarkedAsUnsafeInChildWindow$LWS(virtualEnvironmentEvaluator$LWS, 'eval');
+      if (!isGaterEnabledFeature$LWS('changesSince.262')) {
+        throwIfMarkedAsUnsafeInChildWindow$LWS(virtualEnvironmentEvaluator$LWS, 'eval');
+      }
       return sandboxEvaluator$LWS(transformSourceText$LWS(toSafeStringValue$LWS(sourceText$LWS)), UNCOMPILED_CONTEXT$LWS);
     }];
   };
@@ -7084,7 +7497,9 @@ function initDistortionFunction$LWS({
     virtualEnvironmentEvaluator: virtualEnvironmentEvaluator$LWS
   }) {
     return [originalFunction$LWS, function Function$LWS(...args$LWS) {
-      throwIfMarkedAsUnsafeInChildWindow$LWS(virtualEnvironmentEvaluator$LWS, 'Function');
+      if (!isGaterEnabledFeature$LWS('changesSince.262')) {
+        throwIfMarkedAsUnsafeInChildWindow$LWS(virtualEnvironmentEvaluator$LWS, 'Function');
+      }
       // The `arguments` object has `Symbol.iterator` as an own
       // property, not inherited, so it avoids prototype pollution
       // attacks.
@@ -7168,6 +7583,52 @@ function initDistortionHistoryReplaceState$LWS({
     return distortionEntry$LWS;
   };
 }
+
+// Anchor elements allow blob: URLs in addition to standard schemes for download links
+const ANCHOR_URL_SCHEMES_LIST$LWS = toSafeArray$LWS$1(['about:', 'blob:', 'http:', 'https:']);
+function isValidAnchorURLScheme$LWS(url$LWS) {
+  ReflectApply$LWS$1(HTMLAnchorElementProtoHrefSetter$LWS, normalizerAnchor$LWS, [url$LWS]);
+  return ANCHOR_URL_SCHEMES_LIST$LWS.includes(ReflectApply$LWS$1(HTMLAnchorElementProtoProtocolGetter$LWS, normalizerAnchor$LWS, []));
+}
+function initDistortionHTMLAnchorElementHrefSetter$LWS({
+  globalObject: {
+    HTMLAnchorElement: HTMLAnchorElement$LWS
+  }
+}) {
+  const originalHrefSetter$LWS = ObjectLookupOwnSetter$LWS(HTMLAnchorElement$LWS.prototype, 'href');
+  function href$LWS(value$LWS) {
+    const urlString$LWS = sanitizeURLForElement$LWS(value$LWS);
+    if (isGaterEnabledFeature$LWS('htmlAnchorElementHrefValidation') && !isValidAnchorURLScheme$LWS(urlString$LWS)) {
+      throw new LockerSecurityError$LWS('HTMLAnchorElement.href supports http://, https://, blob: schemes, relative urls and about:blank.');
+    }
+    ReflectApply$LWS$1(HTMLAnchorElementProtoHrefSetter$LWS, this, [urlString$LWS]);
+  }
+  const distortionEntry$LWS = [originalHrefSetter$LWS, href$LWS];
+  return function distortionHTMLAnchorElementHrefSetter$LWS(record$LWS) {
+    if (isGaterEnabledFeature$LWS('htmlAnchorElementHrefValidation')) {
+      registerAttributeDistortion$LWS(record$LWS, HTMLAnchorElement$LWS, 'href', NAMESPACE_DEFAULT$LWS, href$LWS);
+    }
+    // This will fall back to the original href setter if the gate is not enabled
+    return distortionEntry$LWS;
+  };
+}
+function initDistortionHTMLBaseElementHrefSetter$LWS({
+  globalObject: {
+    HTMLBaseElement: HTMLBaseElement$LWS
+  }
+}) {
+  const originalHrefSetter$LWS = ObjectLookupOwnSetter$LWS(HTMLBaseElement$LWS.prototype, 'href');
+  function href$LWS(...args$LWS) {
+    if (isGaterEnabledFeature$LWS('changesSince.262')) {
+      throw new LockerSecurityError$LWS('Cannot set HTMLBaseElement.href.');
+    }
+    return ReflectApply$LWS$1(originalHrefSetter$LWS, this, args$LWS);
+  }
+  const distortionEntry$LWS = [originalHrefSetter$LWS, href$LWS];
+  return function distortionHTMLBaseElementHrefSetter$LWS() {
+    return distortionEntry$LWS;
+  };
+}
 function initDistortionHTMLBodyElementOnrejectionhandled$LWS({
   globalObject: {
     HTMLBodyElement: HTMLBodyElement$LWS
@@ -7189,6 +7650,36 @@ function initDistortionHTMLBodyElementOnunhandledrejection$LWS({
 }) {
   return createEventDistortionFactory$LWS(HTMLBodyElement$LWS.prototype, HTMLBodyElement$LWS, 'unhandledrejection');
 }
+function initDistortionHTMLButtonElementFormActionSetter$LWS({
+  globalObject: {
+    HTMLButtonElement: HTMLButtonElement$LWS
+  }
+}) {
+  const originalFormActionSetter$LWS = ObjectLookupOwnSetter$LWS(HTMLButtonElement$LWS.prototype, 'formAction');
+  return function distortionHTMLButtonElementFormActionSetter$LWS(record$LWS) {
+    if (isGaterEnabledFeature$LWS('changesSince.262')) {
+      function formAction$LWS(value$LWS) {
+        const normalizedValue$LWS = toSafeStringValue$LWS(value$LWS);
+        let urlString$LWS = '';
+        if (normalizedValue$LWS !== '') {
+          const parsedURL$LWS = parseURL$LWS(normalizedValue$LWS);
+          const {
+            normalizedURL: normalizedURL$LWS
+          } = parsedURL$LWS;
+          if (!isAllowedEndpointURL$LWS(parsedURL$LWS)) {
+            throw new LockerSecurityError$LWS(`Cannot set form action to disallowed endpoint: ${toSafeTemplateStringValue$LWS(normalizedURL$LWS)}`);
+          }
+          urlString$LWS = normalizedURL$LWS;
+        }
+        ReflectApply$LWS$1(HTMLButtonElementProtoFormActionSetter$LWS, this, [urlString$LWS]);
+      }
+      registerAttributeDistortion$LWS(record$LWS, HTMLButtonElement$LWS, 'formaction', NAMESPACE_DEFAULT$LWS, formAction$LWS);
+      return [originalFormActionSetter$LWS, formAction$LWS];
+    }
+    // istanbul ignore next: ungated return is not reachable in coverage runs
+    return [originalFormActionSetter$LWS, originalFormActionSetter$LWS];
+  };
+}
 function initDistortionHTMLElementCtor$LWS({
   document: document$LWS,
   globalObject: {
@@ -7228,8 +7719,26 @@ function initDistortionHTMLElementDatasetGetter$LWS({
     return distortionEntry$LWS;
   };
 }
+function initDistortionHTMLElementInnerTextGetter$LWS({
+  globalObject: globalObject$LWS
+}) {
+  const originalInnerTextGetter$LWS = ObjectLookupOwnGetter$LWS$1(globalObject$LWS.HTMLElement.prototype, 'innerText');
+  // istanbul ignore if: currently unreachable via tests
+  if (typeof originalInnerTextGetter$LWS !== 'function') {
+    return noop$LWS$1;
+  }
+  const distortionEntry$LWS = [originalInnerTextGetter$LWS, function innerText$LWS() {
+    if (isGaterEnabledFeature$LWS('changesSince.262') && isUnknownScriptElement$LWS(this, globalObject$LWS)) {
+      return '';
+    }
+    return ReflectApply$LWS$1(originalInnerTextGetter$LWS, this, []);
+  }];
+  return function distortionHTMLElementInnerTextGetter$LWS() {
+    return distortionEntry$LWS;
+  };
+}
 const {
-  isSharedElement: isSharedElement$e$LWS
+  isSharedElement: isSharedElement$m$LWS
 } = rootValidator$LWS;
 function initDistortionHTMLElementInnerTextSetter$LWS({
   globalObject: {
@@ -7243,7 +7752,7 @@ function initDistortionHTMLElementInnerTextSetter$LWS({
   }
   const distortionEntry$LWS = [originalInnerTextSetter$LWS, function innerText$LWS(value$LWS) {
     // istanbul ignore else: needs default platform behavior test
-    if (isSharedElement$e$LWS(this)) {
+    if (isSharedElement$m$LWS(this)) {
       throw new LockerSecurityError$LWS(`Cannot set innerText of ${ReflectApply$LWS$1(NodeProtoNodeNameGetter$LWS, this, [])}.`);
     }
     ReflectApply$LWS$1(originalInnerTextSetter$LWS, this, [value$LWS]);
@@ -7263,7 +7772,7 @@ function initDistortionHTMLElementOnsecuritypolicyviolation$LWS({
   return createEventDistortionFactory$LWS(HTMLElementProto$LWS, HTMLElement$LWS, 'securitypolicyviolation');
 }
 const {
-  isSharedElement: isSharedElement$d$LWS
+  isSharedElement: isSharedElement$l$LWS
 } = rootValidator$LWS;
 // The outerText property is non-standard, so the descriptor could be undefined,
 // like in the case of Firefox.
@@ -7280,7 +7789,7 @@ function initDistortionHTMLElementOuterTextSetter$LWS({
   }
   const distortionEntry$LWS = [originalOuterTextSetter$LWS, function outerText$LWS(value$LWS) {
     // istanbul ignore else: needs default platform behavior test
-    if (isSharedElement$d$LWS(this)) {
+    if (isSharedElement$l$LWS(this)) {
       throw new LockerSecurityError$LWS(`Cannot set outerText of ${ReflectApply$LWS$1(NodeProtoNodeNameGetter$LWS, this, [])}.`);
     }
     ReflectApply$LWS$1(originalOuterTextSetter$LWS, this, [value$LWS]);
@@ -7302,6 +7811,36 @@ function initDistortionHTMLElementStyleGetter$LWS({
     return distortionEntry$LWS;
   };
 }
+function initDistortionHTMLFormElementActionSetter$LWS({
+  globalObject: {
+    HTMLFormElement: HTMLFormElement$LWS
+  }
+}) {
+  const originalActionSetter$LWS = ObjectLookupOwnSetter$LWS(HTMLFormElement$LWS.prototype, 'action');
+  return function distortionHTMLFormElementActionSetter$LWS(record$LWS) {
+    if (isGaterEnabledFeature$LWS('changesSince.262')) {
+      function action$LWS(value$LWS) {
+        const normalizedActionValue$LWS = toSafeStringValue$LWS(value$LWS);
+        let urlString$LWS = '';
+        if (normalizedActionValue$LWS !== '') {
+          const parsedURL$LWS = parseURL$LWS(normalizedActionValue$LWS);
+          const {
+            normalizedURL: normalizedURL$LWS
+          } = parsedURL$LWS;
+          if (!isAllowedEndpointURL$LWS(parsedURL$LWS)) {
+            throw new LockerSecurityError$LWS(`Cannot set form action to disallowed endpoint: ${toSafeTemplateStringValue$LWS(normalizedURL$LWS)}`);
+          }
+          urlString$LWS = normalizedURL$LWS;
+        }
+        ReflectApply$LWS$1(HTMLFormElementProtoActionSetter$LWS, this, [urlString$LWS]);
+      }
+      registerAttributeDistortion$LWS(record$LWS, HTMLFormElement$LWS, 'action', NAMESPACE_DEFAULT$LWS, action$LWS);
+      return [originalActionSetter$LWS, action$LWS];
+    }
+    // istanbul ignore next: ungated return is not reachable in coverage runs
+    return [originalActionSetter$LWS, originalActionSetter$LWS];
+  };
+}
 function initDistortionHTMLFrameSetElementOnrejectionhandled$LWS({
   globalObject: {
     HTMLFrameSetElement: HTMLFrameSetElement$LWS
@@ -7431,6 +7970,13 @@ function initDistortionHTMLIFrameElementSrcSetter$LWS({
   return function distortionHTMLIFrameElementSrcSetter$LWS(record$LWS) {
     function src$LWS(value$LWS) {
       const normalizedSrcValue$LWS = toSafeStringValue$LWS(value$LWS);
+      // This must be done on the raw value before sanitization, because sanitization can
+      // remove the exploit pattern.
+      if (isGaterEnabledFeature$LWS('changesSince.262')) {
+        if (isAttemptingToExploitURL$LWS(normalizedSrcValue$LWS)) {
+          throw new LockerSecurityError$LWS(`Cannot set src to "${toSafeTemplateStringValue$LWS(normalizedSrcValue$LWS)}"`);
+        }
+      }
       // If the string being set to iframe.src is not an empty string, sanitize it for assignment
       // to iframe.src. If it is an empty string, let it be and proceed.
       // Otherwise, take no action.
@@ -7440,7 +7986,7 @@ function initDistortionHTMLIFrameElementSrcSetter$LWS({
       }
       if (isGaterEnabledFeature$LWS('changesSince.258')) {
         const parsedURL$LWS = parseURL$LWS(urlString$LWS);
-        if (!isValidURL$LWS(parsedURL$LWS)) {
+        if (!isAllowedEndpointURL$LWS(parsedURL$LWS)) {
           const {
             normalizedURL: normalizedURL$LWS
           } = parsedURL$LWS;
@@ -7473,6 +8019,36 @@ function initDistortionHTMLIFrameElementSandboxSetter$LWS({
     return [originalSandboxSetter$LWS, sandbox$LWS];
   };
 }
+function initDistortionHTMLInputElementFormActionSetter$LWS({
+  globalObject: {
+    HTMLInputElement: HTMLInputElement$LWS
+  }
+}) {
+  const originalFormActionSetter$LWS = ObjectLookupOwnSetter$LWS(HTMLInputElement$LWS.prototype, 'formAction');
+  return function distortionHTMLInputElementFormActionSetter$LWS(record$LWS) {
+    if (isGaterEnabledFeature$LWS('changesSince.262')) {
+      function formAction$LWS(value$LWS) {
+        const normalizedValue$LWS = toSafeStringValue$LWS(value$LWS);
+        let urlString$LWS = '';
+        if (normalizedValue$LWS !== '') {
+          const parsedURL$LWS = parseURL$LWS(normalizedValue$LWS);
+          const {
+            normalizedURL: normalizedURL$LWS
+          } = parsedURL$LWS;
+          if (!isAllowedEndpointURL$LWS(parsedURL$LWS)) {
+            throw new LockerSecurityError$LWS(`Cannot set form action to disallowed endpoint: ${toSafeTemplateStringValue$LWS(normalizedURL$LWS)}`);
+          }
+          urlString$LWS = normalizedURL$LWS;
+        }
+        ReflectApply$LWS$1(HTMLInputElementProtoFormActionSetter$LWS, this, [urlString$LWS]);
+      }
+      registerAttributeDistortion$LWS(record$LWS, HTMLInputElement$LWS, 'formaction', NAMESPACE_DEFAULT$LWS, formAction$LWS);
+      return [originalFormActionSetter$LWS, formAction$LWS];
+    }
+    // istanbul ignore next: ungated return is not reachable in coverage runs
+    return [originalFormActionSetter$LWS, originalFormActionSetter$LWS];
+  };
+}
 const importRegExp$LWS = /import/i;
 const WARN_MESSAGE$LWS = 'Lightning Web Security: HTMLLinkElement does not allow setting "rel" property to "import" value.';
 function isValidRelValue$LWS(value$LWS) {
@@ -7517,6 +8093,24 @@ function initDistortionHTMLLinkElementRelListSetter$LWS({
     return distortionEntry$LWS;
   };
 }
+function initDistortionHTMLMetaElementContentGetter$LWS({
+  globalObject: {
+    HTMLMetaElement: HTMLMetaElement$LWS
+  }
+}) {
+  const originalContentGetter$LWS = ObjectLookupOwnGetter$LWS$1(HTMLMetaElement$LWS.prototype, 'content');
+  const distortionEntry$LWS = [originalContentGetter$LWS, function content$LWS() {
+    const originalContent$LWS = ReflectApply$LWS$1(originalContentGetter$LWS, this, []);
+    if (isGaterEnabledFeature$LWS('changesSince.262')) {
+      return removeNoncePatterns$LWS(originalContent$LWS);
+    }
+    // istanbul ignore next: ungated return is not reachable in coverage runs
+    return originalContent$LWS;
+  }];
+  return function distortionHTMLMetaElementContentGetter$LWS() {
+    return distortionEntry$LWS;
+  };
+}
 function initDistortionHTMLObjectElementDataSetter$LWS({
   globalObject: {
     HTMLObjectElement: HTMLObjectElement$LWS
@@ -7529,7 +8123,7 @@ function initDistortionHTMLObjectElementDataSetter$LWS({
       throw new LockerSecurityError$LWS('HTMLObjectElement.data supports http://, https:// schemes, relative urls and about:blank.');
     }
     const parsedURL$LWS = parseURL$LWS(urlString$LWS);
-    if (!isValidURL$LWS(parsedURL$LWS)) {
+    if (!isAllowedEndpointURL$LWS(parsedURL$LWS)) {
       throw new LockerSecurityError$LWS(`Cannot request disallowed endpoint: ${parsedURL$LWS.normalizedURL}`);
     }
     ReflectApply$LWS$1(originalDataSetter$LWS, this, [trusted.createScriptURL(urlString$LWS)]);
@@ -7540,6 +8134,35 @@ function initDistortionHTMLObjectElementDataSetter$LWS({
     return distortionEntry$LWS;
   };
 }
+function initDistortionHTMLScriptElementInnerTextGetter$LWS({
+  globalObject: globalObject$LWS
+}) {
+  const {
+    HTMLScriptElement: HTMLScriptElement$LWS
+  } = globalObject$LWS;
+  const descriptor$LWS = ReflectGetOwnPropertyDescriptor$LWS(HTMLScriptElement$LWS.prototype, 'innerText');
+  // This may not be implemented in all browsers.
+  // https://www.w3.org/TR/trusted-types/#enforcement-in-scripts
+  if (!isGaterEnabledFeature$LWS('changesSince.262') || !descriptor$LWS) {
+    return noop$LWS$1;
+  }
+  // istanbul ignore next: currently not implemented in Chrome (used for coverage collection)
+  const {
+    get: originalInnerTextGetter$LWS
+  } = descriptor$LWS;
+  // istanbul ignore next: currently not implemented in Chrome (used for coverage collection)
+  const distortionEntry$LWS = [originalInnerTextGetter$LWS, function innerText$LWS() {
+    var _getOriginalScriptPro2$LWS;
+    if (isUnknownScriptElement$LWS(this, globalObject$LWS)) {
+      return '';
+    }
+    return (_getOriginalScriptPro2$LWS = getOriginalScriptProperty$LWS(this)) != null ? _getOriginalScriptPro2$LWS : ReflectApply$LWS$1(originalInnerTextGetter$LWS, this, []);
+  }];
+  // istanbul ignore next: currently not implemented in Chrome (used for coverage collection)
+  return function distortionHTMLScriptElementInnerTextGetter$LWS() {
+    return distortionEntry$LWS;
+  };
+}
 const descriptorCaches$LWS = toSafeWeakMap$LWS$1(new WeakMapCtor$LWS$1());
 function createBlockedAttributeDistortionFactoryInitializer$LWS(Ctor$LWS, ctorName$LWS, attributeName$LWS) {
   return function initDistortionBlockedAttribute$LWS() {
@@ -7672,6 +8295,14 @@ function addBlockedPropertyDistortionFactoryInitializers$LWS({
     }
   }
 }
+// @ts-ignore value and eval/Function have different type defs, but that's ok for identity comparison
+function throwIfUnsafeCallbackReference$LWS(value$LWS) {
+  if (typeof value$LWS === 'function' && (
+  // @ts-ignore
+  value$LWS === eval || value$LWS === Function)) {
+    throw new LockerSecurityError$LWS('Cannot pass unsafe eval or Function reference.');
+  }
+}
 const scriptURLs$LWS = toSafeWeakMap$LWS$1(new WeakMapCtor$LWS$1());
 function trackScriptURL$LWS(targetElement$LWS, url$LWS) {
   scriptURLs$LWS.set(targetElement$LWS, url$LWS);
@@ -7679,6 +8310,13 @@ function trackScriptURL$LWS(targetElement$LWS, url$LWS) {
 function getScriptURL$LWS(targetElement$LWS) {
   return scriptURLs$LWS.get(targetElement$LWS);
 }
+const svgAnimatedStringOwners$LWS = toSafeWeakMap$LWS$1(new WeakMapCtor$LWS$1());
+function trackSVGAnimatedStringOwner$LWS(animatedString$LWS, owner$LWS) {
+  svgAnimatedStringOwners$LWS.set(animatedString$LWS, owner$LWS);
+}
+function getSVGAnimatedStringOwner$LWS(animatedString$LWS) {
+  return svgAnimatedStringOwners$LWS.get(animatedString$LWS);
+}
 function createScriptDistortion$LWS({
   sandboxEvaluator: sandboxEvaluator$LWS
 }, attributeName$LWS) {
@@ -7735,6 +8373,24 @@ function initDistortionHTMLScriptElementSrcSetter$LWS({
     return [originalSrcSetter$LWS, src$LWS];
   };
 }
+function initDistortionHTMLScriptElementTextGetter$LWS({
+  globalObject: globalObject$LWS
+}) {
+  const {
+    HTMLScriptElement: HTMLScriptElement$LWS
+  } = globalObject$LWS;
+  const originalTextGetter$LWS = ObjectLookupOwnGetter$LWS$1(HTMLScriptElement$LWS.prototype, 'text');
+  const distortionEntry$LWS = [originalTextGetter$LWS, function text$LWS() {
+    var _getOriginalScriptPro3$LWS;
+    if (isGaterEnabledFeature$LWS('changesSince.262') && isUnknownScriptElement$LWS(this, globalObject$LWS)) {
+      return '';
+    }
+    return (_getOriginalScriptPro3$LWS = getOriginalScriptProperty$LWS(this)) != null ? _getOriginalScriptPro3$LWS : ReflectApply$LWS$1(originalTextGetter$LWS, this, []);
+  }];
+  return function distortionHTMLScriptElementTextGetter$LWS() {
+    return distortionEntry$LWS;
+  };
+}
 function initDistortionHTMLScriptElementTextSetter$LWS({
   globalObject: {
     HTMLScriptElement: HTMLScriptElement$LWS
@@ -7765,10 +8421,11 @@ function initDistortionHTMLScriptElementTextSetter$LWS({
   };
 }
 function initDistortionHTMLScriptElementTextContentGetter$LWS({
-  globalObject: {
-    HTMLScriptElement: HTMLScriptElement$LWS
-  }
+  globalObject: globalObject$LWS
 }) {
+  const {
+    HTMLScriptElement: HTMLScriptElement$LWS
+  } = globalObject$LWS;
   const descriptor$LWS = ReflectGetOwnPropertyDescriptor$LWS(HTMLScriptElement$LWS.prototype, 'textContent');
   // This may not be implemented in all browsers.
   // https://www.w3.org/TR/trusted-types/#enforcement-in-scripts
@@ -7781,8 +8438,11 @@ function initDistortionHTMLScriptElementTextContentGetter$LWS({
   } = descriptor$LWS;
   // istanbul ignore next: currently not implemented in Chrome (used for coverage collection)
   const distortionEntry$LWS = [originalTextContentGetter$LWS, function textContent$LWS() {
-    var _getOriginalScriptPro$LWS;
-    return (_getOriginalScriptPro$LWS = getOriginalScriptProperty$LWS(this)) != null ? _getOriginalScriptPro$LWS : ReflectApply$LWS$1(originalTextContentGetter$LWS, this, []);
+    var _getOriginalScriptPro4$LWS;
+    if (isGaterEnabledFeature$LWS('changesSince.262') && isUnknownScriptElement$LWS(this, globalObject$LWS)) {
+      return '';
+    }
+    return (_getOriginalScriptPro4$LWS = getOriginalScriptProperty$LWS(this)) != null ? _getOriginalScriptPro4$LWS : ReflectApply$LWS$1(originalTextContentGetter$LWS, this, []);
   }];
   // istanbul ignore next: currently not implemented in Chrome (used for coverage collection)
   return function distortionHTMLScriptElementSrcGetter$LWS() {
@@ -7823,6 +8483,88 @@ function initDistortionHTMLScriptElementTextContentSetter$LWS({
     }];
   };
 }
+function initDistortionIDBFactoryDatabases$LWS({
+  globalObject: {
+    IDBFactory: IDBFactory$LWS
+  }
+}) {
+  var _IDBFactory$prototype$LWS;
+  const originalDatabases$LWS = IDBFactory$LWS == null || (_IDBFactory$prototype$LWS = IDBFactory$LWS.prototype) == null ? void 0 : _IDBFactory$prototype$LWS.databases;
+  if (typeof originalDatabases$LWS !== 'function') {
+    return noop$LWS$1;
+  }
+  return function distortionIDBFactoryDatabases$LWS({
+    key: key$LWS
+  }) {
+    return [originalDatabases$LWS, function databases$LWS() {
+      const databasesResultPromise$LWS = ReflectApply$LWS$1(originalDatabases$LWS, this, []);
+      if (!isGaterEnabledFeature$LWS('changesSince.262')) {
+        return databasesResultPromise$LWS;
+      }
+      return ReflectApply$LWS$1(PromiseProtoThen$LWS, databasesResultPromise$LWS, [result$LWS => {
+        const sandboxedDatabases$LWS = [];
+        let sandboxedDatabasesOffset$LWS = 0;
+        for (let i$LWS = 0, {
+            length: length$LWS
+          } = result$LWS; i$LWS < length$LWS; i$LWS += 1) {
+          const dbInfo$LWS = result$LWS[i$LWS];
+          const {
+            name: name$LWS
+          } = dbInfo$LWS;
+          if (name$LWS !== undefined && startsWithNamespaceMarker$LWS(name$LWS, key$LWS)) {
+            sandboxedDatabases$LWS[sandboxedDatabasesOffset$LWS++] = {
+              name: removeNamespaceMarker$LWS(name$LWS, key$LWS),
+              version: dbInfo$LWS.version
+            };
+          }
+        }
+        return sandboxedDatabases$LWS;
+      }]);
+    }];
+  };
+}
+function initDistortionIDBFactoryDeleteDatabase$LWS({
+  globalObject: {
+    IDBFactory: IDBFactory$LWS
+  }
+}) {
+  var _IDBFactory$prototype2$LWS;
+  const originalDeleteDatabase$LWS = IDBFactory$LWS == null || (_IDBFactory$prototype2$LWS = IDBFactory$LWS.prototype) == null ? void 0 : _IDBFactory$prototype2$LWS.deleteDatabase;
+  if (typeof originalDeleteDatabase$LWS !== 'function') {
+    return noop$LWS$1;
+  }
+  return function distortionIDBFactoryDeleteDatabase$LWS({
+    key: key$LWS
+  }) {
+    return [originalDeleteDatabase$LWS, function deleteDatabase$LWS(...args$LWS) {
+      if (args$LWS.length && isGaterEnabledFeature$LWS('changesSince.262')) {
+        args$LWS[0] = prependNamespaceMarker$LWS(args$LWS[0], key$LWS);
+      }
+      return ReflectApply$LWS$1(originalDeleteDatabase$LWS, this, args$LWS);
+    }];
+  };
+}
+function initDistortionIDBFactoryOpen$LWS({
+  globalObject: {
+    IDBFactory: IDBFactory$LWS
+  }
+}) {
+  var _IDBFactory$prototype3$LWS;
+  const originalOpen$LWS = IDBFactory$LWS == null || (_IDBFactory$prototype3$LWS = IDBFactory$LWS.prototype) == null ? void 0 : _IDBFactory$prototype3$LWS.open;
+  if (typeof originalOpen$LWS !== 'function') {
+    return noop$LWS$1;
+  }
+  return function distortionIDBFactoryOpen$LWS({
+    key: key$LWS
+  }) {
+    return [originalOpen$LWS, function open$LWS(...args$LWS) {
+      if (args$LWS.length && isGaterEnabledFeature$LWS('changesSince.262')) {
+        args$LWS[0] = prependNamespaceMarker$LWS(args$LWS[0], key$LWS);
+      }
+      return ReflectApply$LWS$1(originalOpen$LWS, this, args$LWS);
+    }];
+  };
+}
 function initDistortionIDBObjectStoreAdd$LWS({
   globalObject: {
     DOMException: DOMException$LWS,
@@ -7930,6 +8672,31 @@ function initDistortionMessagePortPostMessage$LWS({
     return distortionEntry$LWS;
   };
 }
+const {
+  isSharedElement: isSharedElement$k$LWS
+} = rootValidator$LWS;
+function initDistortionMutationObserverObserve$LWS({
+  globalObject: {
+    MutationObserver: {
+      prototype: {
+        observe: originalObserve$LWS
+      }
+    }
+  }
+}) {
+  const distortionEntry$LWS = [originalObserve$LWS, function observe$LWS(...args$LWS) {
+    const {
+      0: target$LWS
+    } = args$LWS;
+    if (isGaterEnabledFeature$LWS('changesSince.262') && target$LWS && isSharedElement$k$LWS(target$LWS)) {
+      throw new LockerSecurityError$LWS(`Cannot observe mutations on shared element ${ReflectApply$LWS$1(NodeProtoNodeNameGetter$LWS, target$LWS, [])}.`);
+    }
+    return ReflectApply$LWS$1(originalObserve$LWS, this, args$LWS);
+  }];
+  return function distortionMutationObserverObserve$LWS() {
+    return distortionEntry$LWS;
+  };
+}
 function initDistortionNamedNodeMapSetNamedItem$LWS({
   globalObject: {
     Attr: Attr$LWS,
@@ -7982,7 +8749,7 @@ function initDistortionNavigatorSendBeacon$LWS({
   const distortionEntry$LWS = [originalSendBeacon$LWS, function sendBeacon$LWS(...args$LWS) {
     if (args$LWS.length) {
       const parsedURL$LWS = parseURL$LWS(toSafeStringValue$LWS(args$LWS[0]));
-      if (!isValidURL$LWS(parsedURL$LWS)) {
+      if (!isAllowedEndpointURL$LWS(parsedURL$LWS)) {
         throw new LockerSecurityError$LWS(`Cannot request disallowed endpoint: ${parsedURL$LWS.normalizedURL}`);
       }
       args$LWS[0] = parsedURL$LWS.normalizedURL;
@@ -8009,7 +8776,7 @@ function initDistortionNavigatorServiceWorkerGetter$LWS({
   };
 }
 const {
-  isSharedElement: isSharedElement$c$LWS,
+  isSharedElement: isSharedElement$j$LWS,
   isAllowedSharedElementChild: isAllowedSharedElementChild$1$LWS
 } = rootValidator$LWS;
 function initDistortionNodeInsertBefore$LWS({
@@ -8032,7 +8799,7 @@ function initDistortionNodeInsertBefore$LWS({
         0: node$LWS
       } = args$LWS;
       // istanbul ignore else: needs default platform behavior test
-      if (isSharedElement$c$LWS(this) && !isAllowedSharedElementChild$1$LWS(node$LWS)) {
+      if (isSharedElement$j$LWS(this) && !isAllowedSharedElementChild$1$LWS(node$LWS)) {
         throw new LockerSecurityError$LWS(`Cannot insert child ${ReflectApply$LWS$1(NodeProtoNodeNameGetter$LWS, node$LWS, [])} into ${ReflectApply$LWS$1(NodeProtoNodeNameGetter$LWS, this, [])},`);
       }
     }
@@ -8077,7 +8844,7 @@ function initDistortionNodeValueSetter$LWS({
   };
 }
 const {
-  isSharedElement: isSharedElement$b$LWS
+  isSharedElement: isSharedElement$i$LWS
 } = rootValidator$LWS;
 function initDistortionNodeRemoveChild$LWS({
   globalObject: {
@@ -8098,7 +8865,7 @@ function initDistortionNodeRemoveChild$LWS({
         0: child$LWS
       } = args$LWS;
       // istanbul ignore else: needs default platform behavior test
-      if (isSharedElement$b$LWS(child$LWS)) {
+      if (isSharedElement$i$LWS(child$LWS)) {
         throw new LockerSecurityError$LWS(`Cannot remove ${ReflectApply$LWS$1(NodeProtoNodeNameGetter$LWS, child$LWS, [])}.`);
       }
     }
@@ -8110,7 +8877,7 @@ function initDistortionNodeRemoveChild$LWS({
   };
 }
 const {
-  isSharedElement: isSharedElement$a$LWS
+  isSharedElement: isSharedElement$h$LWS
 } = rootValidator$LWS;
 function initDistortionNodeReplaceChild$LWS({
   globalObject: {
@@ -8134,7 +8901,7 @@ function initDistortionNodeReplaceChild$LWS({
         1: child$LWS
       } = args$LWS;
       // istanbul ignore else: needs default platform behavior test
-      if (isSharedElement$a$LWS(child$LWS)) {
+      if (isSharedElement$h$LWS(child$LWS)) {
         throw new LockerSecurityError$LWS(`Cannot replace ${ReflectApply$LWS$1(NodeProtoNodeNameGetter$LWS, child$LWS, [])}.`);
       }
     }
@@ -8146,19 +8913,18 @@ function initDistortionNodeReplaceChild$LWS({
   };
 }
 function initDistortionNodeTextContentGetter$LWS({
+  globalObject: globalObject$LWS,
   globalObject: {
-    HTMLScriptElement: HTMLScriptElement$LWS,
-    Node: Node$LWS,
-    SVGScriptElement: SVGScriptElement$LWS
+    Node: Node$LWS
   }
 }) {
   const originalTextContentGetter$LWS = ObjectLookupOwnGetter$LWS$1(Node$LWS.prototype, 'textContent');
   const distortionEntry$LWS = [originalTextContentGetter$LWS, function textContent$LWS() {
-    if (this instanceof HTMLScriptElement$LWS || this instanceof SVGScriptElement$LWS) {
-      var _getOriginalScriptPro2$LWS;
-      return (_getOriginalScriptPro2$LWS = getOriginalScriptProperty$LWS(this)) != null ? _getOriginalScriptPro2$LWS : ReflectApply$LWS$1(originalTextContentGetter$LWS, this, []);
+    var _getOriginalScriptPro5$LWS;
+    if (isGaterEnabledFeature$LWS('changesSince.262') && isUnknownScriptElement$LWS(this, globalObject$LWS)) {
+      return '';
     }
-    return ReflectApply$LWS$1(originalTextContentGetter$LWS, this, []);
+    return (_getOriginalScriptPro5$LWS = getOriginalScriptProperty$LWS(this)) != null ? _getOriginalScriptPro5$LWS : ReflectApply$LWS$1(originalTextContentGetter$LWS, this, []);
   }];
   return function distortionHTMLScriptElementSrcGetter$LWS() {
     return distortionEntry$LWS;
@@ -8173,7 +8939,7 @@ function initDistortionNodeTextContentGetter$LWS({
 // magenta global object, which would erroneously prevent code from interacting
 // with that document's <html>, <head> and <body>.
 const {
-  isSharedElement: isSharedElement$9$LWS
+  isSharedElement: isSharedElement$g$LWS
 } = rootValidator$LWS;
 function initDistortionNodeTextContentSetter$LWS({
   globalObject: {
@@ -8228,7 +8994,7 @@ function initDistortionNodeTextContentSetter$LWS({
         }
       }
       // istanbul ignore else: needs default platform behavior test
-      else if (isSharedElement$9$LWS(this)) {
+      else if (isSharedElement$g$LWS(this)) {
         throw new LockerSecurityError$LWS(`Cannot set textContent of ${ReflectApply$LWS$1(NodeProtoNodeNameGetter$LWS, this, [])} elements.`);
       }
       ReflectApply$LWS$1(originalTextContentSetter$LWS, this, [valueAsString$LWS]);
@@ -8274,6 +9040,70 @@ function initDistortionNotificationCtor$LWS({
     return distortionEntry$LWS;
   };
 }
+function initDistortionObservableForEach$LWS({
+  globalObject: {
+    Observable: OriginalObservable$LWS
+  }
+}) {
+  var _OriginalObservable$p$LWS;
+  const originalForEach$LWS = OriginalObservable$LWS == null || (_OriginalObservable$p$LWS = OriginalObservable$LWS.prototype) == null ? void 0 : _OriginalObservable$p$LWS.forEach;
+  if (typeof originalForEach$LWS !== 'function') {
+    return noop$LWS$1;
+  }
+  const distortionEntry$LWS = [originalForEach$LWS, function forEach$LWS(...args$LWS) {
+    if (isGaterEnabledFeature$LWS('changesSince.262')) {
+      throwIfUnsafeCallbackReference$LWS(args$LWS[0]);
+    }
+    return ReflectApply$LWS$1(originalForEach$LWS, this, args$LWS);
+  }];
+  return function distortionObservableForEach$LWS() {
+    return distortionEntry$LWS;
+  };
+}
+function initDistortionObservableSubscribe$LWS({
+  globalObject: {
+    Observable: OriginalObservable$LWS
+  }
+}) {
+  var _OriginalObservable$p2$LWS;
+  const originalSubscribe$LWS = OriginalObservable$LWS == null || (_OriginalObservable$p2$LWS = OriginalObservable$LWS.prototype) == null ? void 0 : _OriginalObservable$p2$LWS.subscribe;
+  if (typeof originalSubscribe$LWS !== 'function') {
+    return noop$LWS$1;
+  }
+  const distortionEntry$LWS = [originalSubscribe$LWS, function subscribe$LWS(...args$LWS) {
+    if (isGaterEnabledFeature$LWS('changesSince.262')) {
+      const {
+        0: observerOrNext$LWS
+      } = args$LWS;
+      if (observerOrNext$LWS !== null && observerOrNext$LWS !== undefined) {
+        if (typeof observerOrNext$LWS === 'function') {
+          throwIfUnsafeCallbackReference$LWS(observerOrNext$LWS);
+        } else if (typeof observerOrNext$LWS === 'object') {
+          // Snapshot properties to prevent TOCTOU: attacker-controlled
+          // getters could return a safe value during the check but
+          // return eval when Observable reads them internally.
+          const {
+            next: next$LWS,
+            error,
+            complete: complete$LWS
+          } = observerOrNext$LWS;
+          throwIfUnsafeCallbackReference$LWS(next$LWS);
+          throwIfUnsafeCallbackReference$LWS(error);
+          throwIfUnsafeCallbackReference$LWS(complete$LWS);
+          args$LWS[0] = {
+            next: next$LWS,
+            error,
+            complete: complete$LWS
+          };
+        }
+      }
+    }
+    return ReflectApply$LWS$1(originalSubscribe$LWS, this, args$LWS);
+  }];
+  return function distortionObservableSubscribe$LWS() {
+    return distortionEntry$LWS;
+  };
+}
 function initDistortionPerformanceMark$LWS({
   globalObject: {
     Performance: {
@@ -8334,51 +9164,342 @@ function initDistortionPerformanceMarkCtor$LWS({
     PerformanceMark: originalPerformanceMarkCtor$LWS
   }
 }) {
-  // istanbul ignore if: needs default platform behavior test
-  if (typeof originalPerformanceMarkCtor$LWS !== 'function') {
-    return noop$LWS$1;
-  }
-  const distortionEntry$LWS = [originalPerformanceMarkCtor$LWS, function PerformanceMark$LWS(...args$LWS) {
-    try {
-      return ReflectConstruct$LWS(originalPerformanceMarkCtor$LWS, args$LWS);
-    } catch (error) {
-      if (args$LWS.length > 1 && error instanceof DOMException$LWS) {
-        const providedOptions$LWS = args$LWS[1];
-        if (isObject$LWS$1(providedOptions$LWS)) {
-          args$LWS[1] = partialStructuredClone$LWS(providedOptions$LWS);
-          return ReflectConstruct$LWS(originalPerformanceMarkCtor$LWS, args$LWS);
+  // istanbul ignore if: needs default platform behavior test
+  if (typeof originalPerformanceMarkCtor$LWS !== 'function') {
+    return noop$LWS$1;
+  }
+  const distortionEntry$LWS = [originalPerformanceMarkCtor$LWS, function PerformanceMark$LWS(...args$LWS) {
+    try {
+      return ReflectConstruct$LWS(originalPerformanceMarkCtor$LWS, args$LWS);
+    } catch (error) {
+      if (args$LWS.length > 1 && error instanceof DOMException$LWS) {
+        const providedOptions$LWS = args$LWS[1];
+        if (isObject$LWS$1(providedOptions$LWS)) {
+          args$LWS[1] = partialStructuredClone$LWS(providedOptions$LWS);
+          return ReflectConstruct$LWS(originalPerformanceMarkCtor$LWS, args$LWS);
+        }
+      }
+      throw error;
+    }
+  }];
+  return function distortionPerformanceMarkCtor$LWS() {
+    return distortionEntry$LWS;
+  };
+}
+function initDistortionPromiseAll$LWS({
+  globalObject: {
+    Promise: Promise$LWS
+  }
+}) {
+  const originalPromiseAll$LWS = Promise$LWS == null ? void 0 : Promise$LWS.all;
+  if (typeof originalPromiseAll$LWS !== 'function') {
+    return noop$LWS$1;
+  }
+  const distortionEntry$LWS = [originalPromiseAll$LWS, function (...args$LWS) {
+    // Always use the real Promise constructor as `this` to prevent
+    // malicious constructors from being passed via Promise.all.call()
+    // that could inject eval as resolve/reject callbacks.
+    if (isGaterEnabledFeature$LWS('changesSince.262')) {
+      return ReflectApply$LWS$1(originalPromiseAll$LWS, Promise$LWS, args$LWS);
+    }
+    return ReflectApply$LWS$1(originalPromiseAll$LWS, this, args$LWS);
+  }];
+  return function distortionPromiseAll$LWS() {
+    return distortionEntry$LWS;
+  };
+}
+function initDistortionPromiseAllSettled$LWS({
+  globalObject: {
+    Promise: Promise$LWS
+  }
+}) {
+  const originalPromiseAllSettled$LWS = Promise$LWS == null ? void 0 : Promise$LWS.allSettled;
+  if (typeof originalPromiseAllSettled$LWS !== 'function') {
+    return noop$LWS$1;
+  }
+  const distortionEntry$LWS = [originalPromiseAllSettled$LWS, function (...args$LWS) {
+    // Always use the real Promise constructor as `this` to prevent
+    // malicious constructors from being passed via Promise.allSettled.call()
+    // that could inject eval as resolve/reject callbacks.
+    if (isGaterEnabledFeature$LWS('changesSince.262')) {
+      return ReflectApply$LWS$1(originalPromiseAllSettled$LWS, Promise$LWS, args$LWS);
+    }
+    return ReflectApply$LWS$1(originalPromiseAllSettled$LWS, this, args$LWS);
+  }];
+  return function distortionPromiseAllSettled$LWS() {
+    return distortionEntry$LWS;
+  };
+}
+function initDistortionPromiseAny$LWS({
+  globalObject: {
+    Promise: Promise$LWS
+  }
+}) {
+  const originalPromiseAny$LWS = Promise$LWS == null ? void 0 : Promise$LWS.any;
+  if (typeof originalPromiseAny$LWS !== 'function') {
+    return noop$LWS$1;
+  }
+  const distortionEntry$LWS = [originalPromiseAny$LWS, function (...args$LWS) {
+    // Always use the real Promise constructor as `this` to prevent
+    // malicious constructors from being passed via Promise.any.call()
+    // that could inject eval as resolve/reject callbacks.
+    if (isGaterEnabledFeature$LWS('changesSince.262')) {
+      return ReflectApply$LWS$1(originalPromiseAny$LWS, Promise$LWS, args$LWS);
+    }
+    return ReflectApply$LWS$1(originalPromiseAny$LWS, this, args$LWS);
+  }];
+  return function distortionPromiseAny$LWS() {
+    return distortionEntry$LWS;
+  };
+}
+function initDistortionPromiseCatch$LWS({
+  globalObject: {
+    Promise: {
+      prototype: PromiseProto$LWS
+    }
+  }
+}) {
+  const originalPromiseCatch$LWS = PromiseProto$LWS == null ? void 0 : PromiseProto$LWS.catch;
+  if (typeof originalPromiseCatch$LWS !== 'function') {
+    return noop$LWS$1;
+  }
+  const distortionEntry$LWS = [originalPromiseCatch$LWS, function (...args$LWS) {
+    if (isGaterEnabledFeature$LWS('changesSince.262')) {
+      throwIfUnsafeCallbackReference$LWS(args$LWS[0]);
+    }
+    return ReflectApply$LWS$1(originalPromiseCatch$LWS, this, args$LWS);
+  }];
+  return function distortionPromiseCatch$LWS() {
+    return distortionEntry$LWS;
+  };
+}
+function initDistortionPromiseFinally$LWS({
+  globalObject: {
+    Promise: {
+      prototype: PromiseProto$LWS
+    }
+  }
+}) {
+  const originalPromiseFinally$LWS = PromiseProto$LWS == null ? void 0 : PromiseProto$LWS.finally;
+  if (typeof originalPromiseFinally$LWS !== 'function') {
+    return noop$LWS$1;
+  }
+  const distortionEntry$LWS = [originalPromiseFinally$LWS, function (...args$LWS) {
+    if (isGaterEnabledFeature$LWS('changesSince.262')) {
+      throwIfUnsafeCallbackReference$LWS(args$LWS[0]);
+    }
+    return ReflectApply$LWS$1(originalPromiseFinally$LWS, this, args$LWS);
+  }];
+  return function distortionPromiseFinally$LWS() {
+    return distortionEntry$LWS;
+  };
+}
+function initDistortionPromiseRace$LWS({
+  globalObject: {
+    Promise: Promise$LWS
+  }
+}) {
+  const originalPromiseRace$LWS = Promise$LWS == null ? void 0 : Promise$LWS.race;
+  if (typeof originalPromiseRace$LWS !== 'function') {
+    return noop$LWS$1;
+  }
+  const distortionEntry$LWS = [originalPromiseRace$LWS, function (...args$LWS) {
+    // Always use the real Promise constructor as `this` to prevent
+    // malicious constructors from being passed via Promise.race.call()
+    // that could inject eval as resolve/reject callbacks.
+    if (isGaterEnabledFeature$LWS('changesSince.262')) {
+      return ReflectApply$LWS$1(originalPromiseRace$LWS, Promise$LWS, args$LWS);
+    }
+    return ReflectApply$LWS$1(originalPromiseRace$LWS, this, args$LWS);
+  }];
+  return function distortionPromiseRace$LWS() {
+    return distortionEntry$LWS;
+  };
+}
+function initDistortionPromiseReject$LWS({
+  globalObject: {
+    Promise: Promise$LWS
+  }
+}) {
+  const originalPromiseReject$LWS = Promise$LWS == null ? void 0 : Promise$LWS.reject;
+  if (typeof originalPromiseReject$LWS !== 'function') {
+    return noop$LWS$1;
+  }
+  const distortionEntry$LWS = [originalPromiseReject$LWS, function (...args$LWS) {
+    // Always use the real Promise constructor as `this` to prevent
+    // malicious constructors from being passed via Promise.reject.call()
+    // that could inject eval as resolve/reject callbacks.
+    if (isGaterEnabledFeature$LWS('changesSince.262')) {
+      return ReflectApply$LWS$1(originalPromiseReject$LWS, Promise$LWS, args$LWS);
+    }
+    return ReflectApply$LWS$1(originalPromiseReject$LWS, this, args$LWS);
+  }];
+  return function distortionPromiseReject$LWS() {
+    return distortionEntry$LWS;
+  };
+}
+function initDistortionPromiseResolve$LWS({
+  globalObject: {
+    Promise: Promise$LWS
+  }
+}) {
+  const originalPromiseResolve$LWS = Promise$LWS == null ? void 0 : Promise$LWS.resolve;
+  if (typeof originalPromiseResolve$LWS !== 'function') {
+    return noop$LWS$1;
+  }
+  const distortionEntry$LWS = [originalPromiseResolve$LWS, function (...args$LWS) {
+    // Always use the real Promise constructor as `this` to prevent
+    // malicious constructors from being passed via Promise.resolve.call()
+    // that could inject eval as resolve/reject callbacks.
+    if (isGaterEnabledFeature$LWS('changesSince.262')) {
+      return ReflectApply$LWS$1(originalPromiseResolve$LWS, Promise$LWS, args$LWS);
+    }
+    return ReflectApply$LWS$1(originalPromiseResolve$LWS, this, args$LWS);
+  }];
+  return function distortionPromiseResolve$LWS() {
+    return distortionEntry$LWS;
+  };
+}
+function initDistortionPromiseThen$LWS({
+  globalObject: {
+    Promise: {
+      prototype: PromiseProto$LWS
+    }
+  }
+}) {
+  const originalPromiseThen$LWS = PromiseProto$LWS == null ? void 0 : PromiseProto$LWS.then;
+  if (typeof originalPromiseThen$LWS !== 'function') {
+    return noop$LWS$1;
+  }
+  const distortionEntry$LWS = [originalPromiseThen$LWS, function then$LWS(...args$LWS) {
+    if (isGaterEnabledFeature$LWS('changesSince.262')) {
+      throwIfUnsafeCallbackReference$LWS(args$LWS[0]);
+      throwIfUnsafeCallbackReference$LWS(args$LWS[1]);
+    }
+    return ReflectApply$LWS$1(originalPromiseThen$LWS, this, args$LWS);
+  }];
+  return function distortionPromiseThen$LWS() {
+    return distortionEntry$LWS;
+  };
+}
+function initDistortionPromiseTry$LWS({
+  globalObject: {
+    Promise: Promise$LWS
+  }
+}) {
+  const originalPromiseTry$LWS = Promise$LWS == null ? void 0 : Promise$LWS.try;
+  if (typeof originalPromiseTry$LWS !== 'function') {
+    return noop$LWS$1;
+  }
+  const distortionEntry$LWS = [originalPromiseTry$LWS, function (...args$LWS) {
+    if (isGaterEnabledFeature$LWS('changesSince.260')) {
+      throwIfUnsafeCallbackReference$LWS(args$LWS[0]);
+    }
+    // Always use the real Promise constructor as `this` to prevent
+    // malicious constructors from being passed via Promise.try.call()
+    // that could inject eval as resolve/reject callbacks.
+    if (isGaterEnabledFeature$LWS('changesSince.262')) {
+      return ReflectApply$LWS$1(originalPromiseTry$LWS, Promise$LWS, args$LWS);
+    }
+    return ReflectApply$LWS$1(originalPromiseTry$LWS, this, args$LWS);
+  }];
+  return function distortionPromiseTry$LWS() {
+    return distortionEntry$LWS;
+  };
+}
+function initDistortionPromiseWithResolvers$LWS({
+  globalObject: {
+    Promise: Promise$LWS
+  }
+}) {
+  const originalPromiseWithResolvers$LWS = Promise$LWS == null ? void 0 : Promise$LWS.withResolvers;
+  if (typeof originalPromiseWithResolvers$LWS !== 'function') {
+    return noop$LWS$1;
+  }
+  const distortionEntry$LWS = [originalPromiseWithResolvers$LWS, function () {
+    // Always use the real Promise constructor as `this` to prevent
+    // malicious constructors from being passed via Promise.withResolvers.call()
+    // that could leak eval as resolve/reject references.
+    if (isGaterEnabledFeature$LWS('changesSince.262')) {
+      return ReflectApply$LWS$1(originalPromiseWithResolvers$LWS, Promise$LWS, []);
+    }
+    return ReflectApply$LWS$1(originalPromiseWithResolvers$LWS, this, []);
+  }];
+  return function distortionPromiseWithResolvers$LWS() {
+    return distortionEntry$LWS;
+  };
+}
+const {
+  isSharedElement: isSharedElement$f$LWS
+} = rootValidator$LWS;
+function initDistortionRangeCloneContents$LWS({
+  globalObject: {
+    AbstractRange: AbstractRange$LWS,
+    Range: {
+      prototype: {
+        cloneContents: originalCloneContents$LWS
+      }
+    }
+  }
+}) {
+  // istanbul ignore next: the null path and right side of the expression for this code is not reachable in the version of chrome used to measure coverage.
+  const {
+    prototype: AbstractRangeProto$LWS
+  } = AbstractRange$LWS != null ? AbstractRange$LWS : Range;
+  const originalEndContainerGetter$LWS = ObjectLookupOwnGetter$LWS$1(AbstractRangeProto$LWS, 'endContainer');
+  const originalStartContainerGetter$LWS = ObjectLookupOwnGetter$LWS$1(AbstractRangeProto$LWS, 'startContainer');
+  const distortionEntry$LWS = [originalCloneContents$LWS, function cloneContents$LWS(...args$LWS) {
+    if (isGaterEnabledFeature$LWS('changesSince.262')) {
+      const containers$LWS = [ReflectApply$LWS$1(originalEndContainerGetter$LWS, this, []), ReflectApply$LWS$1(originalStartContainerGetter$LWS, this, [])];
+      for (let i$LWS = 0, {
+          length: length$LWS
+        } = containers$LWS; i$LWS < length$LWS; i$LWS += 1) {
+        const container$LWS = containers$LWS[i$LWS];
+        if (isSharedElement$f$LWS(container$LWS)) {
+          throw new LockerSecurityError$LWS(`Cannot clone contents of ${ReflectApply$LWS$1(NodeProtoNodeNameGetter$LWS, container$LWS, [])}.`);
         }
       }
-      throw error;
     }
+    return ReflectApply$LWS$1(originalCloneContents$LWS, this, args$LWS);
   }];
-  return function distortionPerformanceMarkCtor$LWS() {
+  return function distortionRangeCloneContents$LWS() {
     return distortionEntry$LWS;
   };
 }
-function initDistortionPromiseTry$LWS({
+const {
+  isSharedElement: isSharedElement$e$LWS
+} = rootValidator$LWS;
+function initDistortionRangeCloneRange$LWS({
   globalObject: {
-    Promise: Promise$LWS
+    AbstractRange: AbstractRange$LWS,
+    Range: {
+      prototype: {
+        cloneRange: originalCloneRange$LWS
+      }
+    }
   }
 }) {
-  const originalPromiseTry$LWS = Promise$LWS == null ? void 0 : Promise$LWS.try;
-  if (typeof originalPromiseTry$LWS !== 'function') {
-    return noop$LWS$1;
-  }
-  const distortionEntry$LWS = [originalPromiseTry$LWS, function (...args$LWS) {
-    const {
-      0: callback$LWS
-    } = args$LWS;
-    if (typeof callback$LWS === 'function') {
-      if (isGaterEnabledFeature$LWS('changesSince.260') &&
-      // @ts-ignore callback and eval have different type defs, but that's ok for this condition
-      callback$LWS === eval) {
-        throw new LockerSecurityError$LWS('Cannot pass unsafe eval reference.');
+  // istanbul ignore next: the null path and right side of the expression for this code is not reachable in the version of chrome used to measure coverage.
+  const {
+    prototype: AbstractRangeProto$LWS
+  } = AbstractRange$LWS != null ? AbstractRange$LWS : Range;
+  const originalEndContainerGetter$LWS = ObjectLookupOwnGetter$LWS$1(AbstractRangeProto$LWS, 'endContainer');
+  const originalStartContainerGetter$LWS = ObjectLookupOwnGetter$LWS$1(AbstractRangeProto$LWS, 'startContainer');
+  const distortionEntry$LWS = [originalCloneRange$LWS, function cloneRange$LWS(...args$LWS) {
+    if (isGaterEnabledFeature$LWS('changesSince.262')) {
+      const containers$LWS = [ReflectApply$LWS$1(originalEndContainerGetter$LWS, this, []), ReflectApply$LWS$1(originalStartContainerGetter$LWS, this, [])];
+      for (let i$LWS = 0, {
+          length: length$LWS
+        } = containers$LWS; i$LWS < length$LWS; i$LWS += 1) {
+        const container$LWS = containers$LWS[i$LWS];
+        if (isSharedElement$e$LWS(container$LWS)) {
+          throw new LockerSecurityError$LWS(`Cannot clone range of ${ReflectApply$LWS$1(NodeProtoNodeNameGetter$LWS, container$LWS, [])}.`);
+        }
       }
     }
-    return ReflectApply$LWS$1(originalPromiseTry$LWS, this, args$LWS);
+    return ReflectApply$LWS$1(originalCloneRange$LWS, this, args$LWS);
   }];
-  return function distortionPromiseTry$LWS() {
+  return function distortionRangeCloneRange$LWS() {
     return distortionEntry$LWS;
   };
 }
@@ -8414,7 +9535,7 @@ function initDistortionRangeCreateContextualFragment$LWS({
   };
 }
 const {
-  isSharedElement: isSharedElement$8$LWS
+  isSharedElement: isSharedElement$d$LWS
 } = rootValidator$LWS;
 function initDistortionRangeDeleteContents$LWS({
   globalObject: {
@@ -8443,7 +9564,7 @@ function initDistortionRangeDeleteContents$LWS({
         length: length$LWS
       } = containers$LWS; i$LWS < length$LWS; i$LWS += 1) {
       const container$LWS = containers$LWS[i$LWS];
-      if (isSharedElement$8$LWS(container$LWS)) {
+      if (isSharedElement$d$LWS(container$LWS)) {
         throw new LockerSecurityError$LWS(`Cannot delete contents of ${ReflectApply$LWS$1(NodeProtoNodeNameGetter$LWS, container$LWS, [])}.`);
       }
     }
@@ -8454,7 +9575,7 @@ function initDistortionRangeDeleteContents$LWS({
   };
 }
 const {
-  isSharedElement: isSharedElement$7$LWS
+  isSharedElement: isSharedElement$c$LWS
 } = rootValidator$LWS;
 function initDistortionRangeExtractContents$LWS({
   globalObject: {
@@ -8483,7 +9604,7 @@ function initDistortionRangeExtractContents$LWS({
         length: length$LWS
       } = containers$LWS; i$LWS < length$LWS; i$LWS += 1) {
       const container$LWS = containers$LWS[i$LWS];
-      if (isSharedElement$7$LWS(container$LWS)) {
+      if (isSharedElement$c$LWS(container$LWS)) {
         throw new LockerSecurityError$LWS(`Cannot extract contents of ${ReflectApply$LWS$1(NodeProtoNodeNameGetter$LWS, container$LWS, [])}.`);
       }
     }
@@ -8494,7 +9615,44 @@ function initDistortionRangeExtractContents$LWS({
   };
 }
 const {
-  isSharedElement: isSharedElement$6$LWS,
+  isSharedElement: isSharedElement$b$LWS
+} = rootValidator$LWS;
+function initDistortionRangeGetBoundingClientRect$LWS({
+  globalObject: {
+    AbstractRange: AbstractRange$LWS,
+    Range: {
+      prototype: {
+        getBoundingClientRect: originalGetBoundingClientRect$LWS
+      }
+    }
+  }
+}) {
+  // istanbul ignore next: the null path and right side of the expression for this code is not reachable in the version of chrome used to measure coverage.
+  const {
+    prototype: AbstractRangeProto$LWS
+  } = AbstractRange$LWS != null ? AbstractRange$LWS : Range;
+  const originalEndContainerGetter$LWS = ObjectLookupOwnGetter$LWS$1(AbstractRangeProto$LWS, 'endContainer');
+  const originalStartContainerGetter$LWS = ObjectLookupOwnGetter$LWS$1(AbstractRangeProto$LWS, 'startContainer');
+  const distortionEntry$LWS = [originalGetBoundingClientRect$LWS, function getBoundingClientRect$LWS(...args$LWS) {
+    if (isGaterEnabledFeature$LWS('changesSince.262')) {
+      const containers$LWS = [ReflectApply$LWS$1(originalEndContainerGetter$LWS, this, []), ReflectApply$LWS$1(originalStartContainerGetter$LWS, this, [])];
+      for (let i$LWS = 0, {
+          length: length$LWS
+        } = containers$LWS; i$LWS < length$LWS; i$LWS += 1) {
+        const container$LWS = containers$LWS[i$LWS];
+        if (isSharedElement$b$LWS(container$LWS)) {
+          throw new LockerSecurityError$LWS(`Cannot get bounding client rect of ${ReflectApply$LWS$1(NodeProtoNodeNameGetter$LWS, container$LWS, [])}.`);
+        }
+      }
+    }
+    return ReflectApply$LWS$1(originalGetBoundingClientRect$LWS, this, args$LWS);
+  }];
+  return function distortionRangeGetBoundingClientRect$LWS() {
+    return distortionEntry$LWS;
+  };
+}
+const {
+  isSharedElement: isSharedElement$a$LWS,
   isAllowedSharedElementChild: isAllowedSharedElementChild$LWS
 } = rootValidator$LWS;
 function initDistortionRangeInsertNode$LWS({
@@ -8514,7 +9672,7 @@ function initDistortionRangeInsertNode$LWS({
     // istanbul ignore else: needs default platform behavior test
     if (args$LWS.length) {
       const commonAncestorContainer$LWS = ReflectApply$LWS$1(originalCommonAncestorContainerGetter$LWS, this, []);
-      if (commonAncestorContainer$LWS && isSharedElement$6$LWS(commonAncestorContainer$LWS) && !isAllowedSharedElementChild$LWS(args$LWS[0])) {
+      if (commonAncestorContainer$LWS && isSharedElement$a$LWS(commonAncestorContainer$LWS) && !isAllowedSharedElementChild$LWS(args$LWS[0])) {
         throw new LockerSecurityError$LWS(`Cannot insert a new child node of ${ReflectApply$LWS$1(NodeProtoNodeNameGetter$LWS, commonAncestorContainer$LWS, [])}.`);
       }
     }
@@ -8525,7 +9683,7 @@ function initDistortionRangeInsertNode$LWS({
   };
 }
 const {
-  isSharedElement: isSharedElement$5$LWS
+  isSharedElement: isSharedElement$9$LWS
 } = rootValidator$LWS;
 function createRangeProtoMethodDistortionFactoryInitializer$LWS(methodName$LWS) {
   return function initDistortionRangeProtoMethod$LWS({
@@ -8550,7 +9708,7 @@ function createRangeProtoMethodDistortionFactoryInitializer$LWS(methodName$LWS)
             0: node$LWS
           } = args$LWS;
           // istanbul ignore else: needs default platform behavior test
-          if (isSharedElement$5$LWS(node$LWS)) {
+          if (isSharedElement$9$LWS(node$LWS)) {
             throw new LockerSecurityError$LWS(`Cannot call ${methodName$LWS} with ${ReflectApply$LWS$1(NodeProtoNodeNameGetter$LWS, node$LWS, [])}.`);
           }
         }
@@ -8573,7 +9731,66 @@ const initDistortionRangeSetStartAfter$LWS = createRangeProtoMethodDistortionFac
 const initDistortionRangeSetStartBefore$LWS = createRangeProtoMethodDistortionFactoryInitializer$LWS('setStartBefore');
 const initDistortionRangeSurroundContents$LWS = createRangeProtoMethodDistortionFactoryInitializer$LWS('surroundContents');
 const {
-  isSharedElement: isSharedElement$4$LWS
+  isSharedElement: isSharedElement$8$LWS
+} = rootValidator$LWS;
+function initDistortionRangeToString$LWS({
+  globalObject: {
+    AbstractRange: AbstractRange$LWS,
+    Range: {
+      prototype: {
+        toString: originalRangeToString$LWS
+      }
+    }
+  }
+}) {
+  // istanbul ignore next: the null path and right side of the expression for this code is not reachable in the version of chrome used to measure coverage.
+  const {
+    prototype: AbstractRangeProto$LWS
+  } = AbstractRange$LWS != null ? AbstractRange$LWS : Range;
+  const originalEndContainerGetter$LWS = ObjectLookupOwnGetter$LWS$1(AbstractRangeProto$LWS, 'endContainer');
+  const originalStartContainerGetter$LWS = ObjectLookupOwnGetter$LWS$1(AbstractRangeProto$LWS, 'startContainer');
+  const distortionEntry$LWS = [originalRangeToString$LWS, function toString$LWS(...args$LWS) {
+    if (isGaterEnabledFeature$LWS('changesSince.262')) {
+      const containers$LWS = [ReflectApply$LWS$1(originalEndContainerGetter$LWS, this, []), ReflectApply$LWS$1(originalStartContainerGetter$LWS, this, [])];
+      for (let i$LWS = 0, {
+          length: length$LWS
+        } = containers$LWS; i$LWS < length$LWS; i$LWS += 1) {
+        const container$LWS = containers$LWS[i$LWS];
+        if (isSharedElement$8$LWS(container$LWS)) {
+          throw new LockerSecurityError$LWS(`Cannot read contents of ${ReflectApply$LWS$1(NodeProtoNodeNameGetter$LWS, container$LWS, [])}.`);
+        }
+      }
+    }
+    return ReflectApply$LWS$1(originalRangeToString$LWS, this, args$LWS);
+  }];
+  return function distortionRangeToString$LWS() {
+    return distortionEntry$LWS;
+  };
+}
+const {
+  isSharedElement: isSharedElement$7$LWS
+} = rootValidator$LWS;
+function initDistortionSelectionAnchorNodeGetter$LWS({
+  globalObject: {
+    Selection: Selection$LWS
+  }
+}) {
+  const originalAnchorNodeGetter$LWS = ObjectLookupOwnGetter$LWS$1(Selection$LWS.prototype, 'anchorNode');
+  const distortionEntry$LWS = [originalAnchorNodeGetter$LWS, function anchorNode$LWS() {
+    const node$LWS = ReflectApply$LWS$1(originalAnchorNodeGetter$LWS, this, []);
+    if (isGaterEnabledFeature$LWS('changesSince.262')) {
+      if (node$LWS && isSharedElement$7$LWS(node$LWS)) {
+        return null;
+      }
+    }
+    return node$LWS;
+  }];
+  return function distortionSelectionAnchorNodeGetter$LWS() {
+    return distortionEntry$LWS;
+  };
+}
+const {
+  isSharedElement: isSharedElement$6$LWS
 } = rootValidator$LWS;
 function initDistortionSelectionCollapse$LWS({
   globalObject: {
@@ -8590,7 +9807,7 @@ function initDistortionSelectionCollapse$LWS({
         0: node$LWS
       } = args$LWS;
       // The first arg to Selection.prototype.collapse is "Node | null"
-      if (node$LWS && isSharedElement$4$LWS(node$LWS)) {
+      if (node$LWS && isSharedElement$6$LWS(node$LWS)) {
         throw new LockerSecurityError$LWS(`Cannot collapse selection to ${ReflectApply$LWS$1(NodeProtoNodeNameGetter$LWS, node$LWS, [])}`);
       }
     }
@@ -8601,7 +9818,7 @@ function initDistortionSelectionCollapse$LWS({
   };
 }
 const {
-  isSharedElement: isSharedElement$3$LWS
+  isSharedElement: isSharedElement$5$LWS
 } = rootValidator$LWS;
 function initDistortionSelectionExtend$LWS({
   globalObject: {
@@ -8617,7 +9834,7 @@ function initDistortionSelectionExtend$LWS({
       const {
         0: node$LWS
       } = args$LWS;
-      if (isSharedElement$3$LWS(node$LWS)) {
+      if (isSharedElement$5$LWS(node$LWS)) {
         throw new LockerSecurityError$LWS(`Cannot extend selection to ${ReflectApply$LWS$1(NodeProtoNodeNameGetter$LWS, node$LWS, [])}`);
       }
     }
@@ -8628,7 +9845,29 @@ function initDistortionSelectionExtend$LWS({
   };
 }
 const {
-  isSharedElement: isSharedElement$2$LWS
+  isSharedElement: isSharedElement$4$LWS
+} = rootValidator$LWS;
+function initDistortionSelectionFocusNodeGetter$LWS({
+  globalObject: {
+    Selection: Selection$LWS
+  }
+}) {
+  const originalFocusNodeGetter$LWS = ObjectLookupOwnGetter$LWS$1(Selection$LWS.prototype, 'focusNode');
+  const distortionEntry$LWS = [originalFocusNodeGetter$LWS, function focusNode$LWS() {
+    const node$LWS = ReflectApply$LWS$1(originalFocusNodeGetter$LWS, this, []);
+    if (isGaterEnabledFeature$LWS('changesSince.262')) {
+      if (node$LWS && isSharedElement$4$LWS(node$LWS)) {
+        return null;
+      }
+    }
+    return node$LWS;
+  }];
+  return function distortionSelectionFocusNodeGetter$LWS() {
+    return distortionEntry$LWS;
+  };
+}
+const {
+  isSharedElement: isSharedElement$3$LWS
 } = rootValidator$LWS;
 function initDistortionSelectionSelectAllChildren$LWS({
   globalObject: {
@@ -8644,7 +9883,7 @@ function initDistortionSelectionSelectAllChildren$LWS({
       const {
         0: node$LWS
       } = args$LWS;
-      if (isSharedElement$2$LWS(node$LWS)) {
+      if (isSharedElement$3$LWS(node$LWS)) {
         throw new LockerSecurityError$LWS(`Cannot select all children of ${ReflectApply$LWS$1(NodeProtoNodeNameGetter$LWS, node$LWS, [])}`);
       }
     }
@@ -8655,7 +9894,7 @@ function initDistortionSelectionSelectAllChildren$LWS({
   };
 }
 const {
-  isSharedElement: isSharedElement$1$LWS
+  isSharedElement: isSharedElement$2$LWS
 } = rootValidator$LWS;
 function initDistortionSelectionSetBaseAndExtent$LWS({
   globalObject: {
@@ -8674,8 +9913,8 @@ function initDistortionSelectionSetBaseAndExtent$LWS({
         0: anchorNode$LWS,
         2: focusNode$LWS
       } = args$LWS;
-      const anchorNodeIsShared$LWS = isSharedElement$1$LWS(anchorNode$LWS);
-      const focusNodeIsShared$LWS = isSharedElement$1$LWS(focusNode$LWS);
+      const anchorNodeIsShared$LWS = isSharedElement$2$LWS(anchorNode$LWS);
+      const focusNodeIsShared$LWS = isSharedElement$2$LWS(focusNode$LWS);
       if (anchorNodeIsShared$LWS || focusNodeIsShared$LWS) {
         const subject$LWS = anchorNodeIsShared$LWS ? anchorNode$LWS : focusNode$LWS;
         throw new LockerSecurityError$LWS(`Cannot set selection with ${ReflectApply$LWS$1(NodeProtoNodeNameGetter$LWS, subject$LWS, [])}`);
@@ -8688,7 +9927,7 @@ function initDistortionSelectionSetBaseAndExtent$LWS({
   };
 }
 const {
-  isSharedElement: isSharedElement$LWS
+  isSharedElement: isSharedElement$1$LWS
 } = rootValidator$LWS;
 function initDistortionSelectionSetPosition$LWS({
   globalObject: {
@@ -8705,7 +9944,7 @@ function initDistortionSelectionSetPosition$LWS({
         0: node$LWS
       } = args$LWS;
       // The first arg to Selection.prototype.setPosition is "Node | null"
-      if (node$LWS && isSharedElement$LWS(node$LWS)) {
+      if (node$LWS && isSharedElement$1$LWS(node$LWS)) {
         throw new LockerSecurityError$LWS(`Cannot set position with ${ReflectApply$LWS$1(NodeProtoNodeNameGetter$LWS, node$LWS, [])}`);
       }
     }
@@ -8715,6 +9954,38 @@ function initDistortionSelectionSetPosition$LWS({
     return distortionEntry$LWS;
   };
 }
+const {
+  isSharedElement: isSharedElement$LWS
+} = rootValidator$LWS;
+function initDistortionSelectionToString$LWS({
+  globalObject: {
+    Selection: {
+      prototype: {
+        toString: originalSelectionToString$LWS
+      }
+    }
+  }
+}) {
+  const originalAnchorNodeGetter$LWS = ObjectLookupOwnGetter$LWS$1(Selection.prototype, 'anchorNode');
+  const originalFocusNodeGetter$LWS = ObjectLookupOwnGetter$LWS$1(Selection.prototype, 'focusNode');
+  const distortionEntry$LWS = [originalSelectionToString$LWS, function toString$LWS(...args$LWS) {
+    if (isGaterEnabledFeature$LWS('changesSince.262')) {
+      const nodes$LWS = [ReflectApply$LWS$1(originalAnchorNodeGetter$LWS, this, []), ReflectApply$LWS$1(originalFocusNodeGetter$LWS, this, [])];
+      for (let i$LWS = 0, {
+          length: length$LWS
+        } = nodes$LWS; i$LWS < length$LWS; i$LWS += 1) {
+        const node$LWS = nodes$LWS[i$LWS];
+        if (node$LWS && isSharedElement$LWS(node$LWS)) {
+          throw new LockerSecurityError$LWS(`Cannot read selection content of ${ReflectApply$LWS$1(NodeProtoNodeNameGetter$LWS, node$LWS, [])}.`);
+        }
+      }
+    }
+    return ReflectApply$LWS$1(originalSelectionToString$LWS, this, args$LWS);
+  }];
+  return function distortionSelectionToString$LWS() {
+    return distortionEntry$LWS;
+  };
+}
 function initDistortionServiceWorkerContainerProto$LWS({
   globalObject: {
     ServiceWorkerContainer: ServiceWorkerContainer$LWS
@@ -8752,6 +10023,9 @@ function initDistortionShadowRootInnerHTMLSetter$LWS({
     }];
   };
 }
+const {
+  isIframeSrcdocScriptAttack: isIframeSrcdocScriptAttack$LWS
+} = rootValidator$LWS;
 function initDistortionShadowRootSetHTMLUnsafe$LWS({
   document: document$LWS,
   globalObject: {
@@ -8770,12 +10044,16 @@ function initDistortionShadowRootSetHTMLUnsafe$LWS({
     key: key$LWS
   }) {
     return [originalSetHTMLUnsafe$LWS, function setHTMLUnsafe$LWS(value$LWS) {
+      const normalizedValue$LWS = lwsInternalPolicy$LWS.createHTML(toSafeStringValue$LWS(value$LWS), key$LWS, ContentType$LWS.HTML);
+      if (isIframeSrcdocScriptAttack$LWS(normalizedValue$LWS)) {
+        throw new LockerSecurityError$LWS(`Cannot 'setHTMLUnsafe' using an unsecure ${toSafeTemplateStringValue$LWS(normalizedValue$LWS)}.`);
+      }
       // This must be called to signal to the virtual
       // CustomElementRegistry that the next thing created
       // MAY CONTAIN a custom element, which must be marked for
       // association to this sandbox.
       setCustomElementsRegistry$LWS(document$LWS, key$LWS);
-      ReflectApply$LWS$1(originalSetHTMLUnsafe$LWS, this, [lwsInternalPolicy$LWS.createHTML(value$LWS, key$LWS, ContentType$LWS.HTML)]);
+      ReflectApply$LWS$1(originalSetHTMLUnsafe$LWS, this, [normalizedValue$LWS]);
     }];
   };
 }
@@ -9166,6 +10444,27 @@ function initDistortionStorage$LWS({
 }
 const initDistortionLocalStorage$LWS = createDistortionStorageFactoryInitializer$LWS('localStorage');
 const initDistortionSessionStorage$LWS = createDistortionStorageFactoryInitializer$LWS('sessionStorage');
+function initDistortionSVGAnimatedStringBaseValSetter$LWS({
+  globalObject: {
+    SVGAnimatedString: SVGAnimatedString$LWS
+  }
+}) {
+  const originalBaseValSetter$LWS = ObjectLookupOwnSetter$LWS(SVGAnimatedString$LWS.prototype, 'baseVal');
+  return function distortionSVGAnimatedStringBaseValSetter$LWS(record$LWS) {
+    const scriptHrefDistortion$LWS = createScriptDistortion$LWS(record$LWS, 'href');
+    const distortionEntry$LWS = [originalBaseValSetter$LWS, function baseVal$LWS(value$LWS) {
+      if (isGaterEnabledFeature$LWS('changesSince.262')) {
+        const ownerElement$LWS = getSVGAnimatedStringOwner$LWS(this);
+        if (ownerElement$LWS) {
+          ReflectApply$LWS$1(scriptHrefDistortion$LWS, ownerElement$LWS, [value$LWS]);
+          return;
+        }
+      }
+      ReflectApply$LWS$1(originalBaseValSetter$LWS, this, [value$LWS]);
+    }];
+    return distortionEntry$LWS;
+  };
+}
 function initDistortionSVGAnimateElementAttributeNameAttribute$LWS({
   globalObject: {
     Element: {
@@ -9318,13 +10617,18 @@ function initDistortionSVGScriptElementHrefGetter$LWS({
   const originalHrefGetter$LWS = ObjectLookupOwnGetter$LWS$1(SVGScriptElement$LWS.prototype, 'href');
   const distortionEntry$LWS = [originalHrefGetter$LWS, function href$LWS() {
     const url$LWS = getScriptURL$LWS(this);
+    let result$LWS;
     // istanbul ignore else: needs default platform behavior test
     if (typeof url$LWS === 'string') {
       ReflectApply$LWS$1(originalSetAttribute$LWS, script$LWS, ['href', trusted.createScriptURL(url$LWS)]);
-      return ReflectApply$LWS$1(originalHrefGetter$LWS, script$LWS, []);
+      result$LWS = ReflectApply$LWS$1(originalHrefGetter$LWS, script$LWS, []);
+    } else {
+      result$LWS = ReflectApply$LWS$1(originalHrefGetter$LWS, this, []);
     }
-    // istanbul ignore next: needs default platform behavior test
-    return ReflectApply$LWS$1(originalHrefGetter$LWS, this, []);
+    if (isGaterEnabledFeature$LWS('changesSince.262')) {
+      trackSVGAnimatedStringOwner$LWS(result$LWS, this);
+    }
+    return result$LWS;
   }];
   return function distortionSVGScriptElementHrefGetter$LWS() {
     return distortionEntry$LWS;
@@ -9479,7 +10783,9 @@ function initDistortionURLCreateObjectURL$LWS({
   // user-code created global objects).
   const {
     isEqualDomString: isEqualDomString$LWS,
-    isInherentlyUnsecure: isInherentlyUnsecure$LWS
+    isIframeSrcdocScriptAttack: isIframeSrcdocScriptAttack$LWS,
+    isXMLEntityAttack: isXMLEntityAttack$LWS,
+    isXMLNamespacedScriptAttack: isXMLNamespacedScriptAttack$LWS
   } = getValidator$LWS(document$LWS, globalObject$LWS);
   return function distortionURLCreateObjectURL$LWS({
     key: key$LWS
@@ -9526,7 +10832,11 @@ function initDistortionURLCreateObjectURL$LWS({
         }
         const responseText$LWS = ReflectApply$LWS$1(XhrProtoResponseTextGetter$LWS, xhr$LWS, []);
         const sanitized$LWS = sanitizer$LWS.sanitize(responseText$LWS);
-        if (!isEqualDomString$LWS(trusted.createHTML(responseText$LWS), trusted.createHTML(sanitized$LWS)) || isInherentlyUnsecure$LWS(responseText$LWS)) {
+        if (!isEqualDomString$LWS(trusted.createHTML(responseText$LWS), trusted.createHTML(sanitized$LWS)) || isIframeSrcdocScriptAttack$LWS(responseText$LWS)) {
+          URLRevokeObjectURL$LWS(outURL$LWS);
+          throw new LockerSecurityError$LWS(createInsecureBlobErrorMessage$LWS(blobObject$LWS));
+        }
+        if (isGaterEnabledFeature$LWS('changesSince.262') && (isXMLEntityAttack$LWS(responseText$LWS) || isXMLNamespacedScriptAttack$LWS(responseText$LWS))) {
           URLRevokeObjectURL$LWS(outURL$LWS);
           throw new LockerSecurityError$LWS(createInsecureBlobErrorMessage$LWS(blobObject$LWS));
         }
@@ -9681,7 +10991,7 @@ function initDistortionWindowFetch$LWS({
         url$LWS = parsedURL$LWS.normalizedURL;
         args$LWS[0] = url$LWS;
       }
-      if (!isValidURL$LWS(parsedURL$LWS)) {
+      if (!isAllowedEndpointURL$LWS(parsedURL$LWS)) {
         const {
           normalizedURL: normalizedURL$LWS
         } = parsedURL$LWS;
@@ -9723,7 +11033,7 @@ function initDistortionWindowFetchLater$LWS({
         url$LWS = parsedURL$LWS.normalizedURL;
         args$LWS[0] = url$LWS;
       }
-      if (!isValidURL$LWS(parsedURL$LWS)) {
+      if (!isAllowedEndpointURL$LWS(parsedURL$LWS)) {
         const {
           normalizedURL: normalizedURL$LWS
         } = parsedURL$LWS;
@@ -9963,6 +11273,42 @@ function initDistortionWindowLengthGetter$LWS({
     return distortionEntry$LWS;
   };
 }
+function initDistortionWindowNameGetter$LWS({
+  globalObject: globalObject$LWS
+}) {
+  const originalNameGetter$LWS = ObjectLookupOwnGetter$LWS$1(globalObject$LWS, 'name');
+  // istanbul ignore if: currently unreachable via tests
+  if (typeof originalNameGetter$LWS !== 'function') {
+    return noop$LWS$1;
+  }
+  const distortionEntry$LWS = [originalNameGetter$LWS, function name$LWS() {
+    if (this === rootWindow$LWS$1) {
+      return '';
+    }
+    return ReflectApply$LWS$1(originalNameGetter$LWS, this, []);
+  }];
+  return function distortionWindowNameGetter$LWS() {
+    return distortionEntry$LWS;
+  };
+}
+function initDistortionWindowNameSetter$LWS({
+  globalObject: globalObject$LWS
+}) {
+  const originalNameSetter$LWS = ObjectLookupOwnSetter$LWS(globalObject$LWS, 'name');
+  // istanbul ignore if: currently unreachable via tests
+  if (typeof originalNameSetter$LWS !== 'function') {
+    return noop$LWS$1;
+  }
+  const distortionEntry$LWS = [originalNameSetter$LWS, function name$LWS(value$LWS) {
+    if (this === rootWindow$LWS$1) {
+      return;
+    }
+    ReflectApply$LWS$1(originalNameSetter$LWS, this, [value$LWS]);
+  }];
+  return function distortionWindowNameSetter$LWS() {
+    return distortionEntry$LWS;
+  };
+}
 function initDistortionWindowOnrejectionhandled$LWS({
   globalObject: globalObject$LWS,
   globalObject: {
@@ -10002,25 +11348,32 @@ function initDistortionWindowOpen$LWS({
 }) {
   const distortionEntry$LWS = [originalWindowOpen$LWS, function open$LWS(...args$LWS) {
     const normalizedArgs$LWS = normalizeWindowOpenArguments$LWS(args$LWS);
-    const childWindow$LWS = ReflectApply$LWS$1(originalWindowOpen$LWS, this, normalizedArgs$LWS);
+    // istanbul ignore next: resourceUrl default is not reachable via tests
     const {
       0: resourceUrl$LWS = ''
     } = normalizedArgs$LWS;
-    // In 256, limit this restriction to urls that can be treated as same-origin
-    // istanbul ignore else: previous behavior will not be tested in collection coverage
-    if (isGaterEnabledFeature$LWS('changesSince.256')) {
-      // This CANNOT be combined with the above condition, because doing so
-      // will result in the else consequent body being executed in the case
-      // where the gate is enabled and the url is not same origin,
-      // which is counter to the goals of this change!!
-      if (isSameOriginURL$LWS(resourceUrl$LWS)) {
-        // W-16032332
-        // Block access to unsafe child window properties
+    if (isGaterEnabledFeature$LWS('changesSince.262') && isAttemptingToExploitURL$LWS(resourceUrl$LWS)) {
+      throw new LockerSecurityError$LWS(`Cannot open: ${resourceUrl$LWS}`);
+    }
+    // Validate that same-origin URLs don't target endpoints that could be exploited
+    // via browsing contexts. Unlike fetch/XHR, browsing contexts (window.open, iframe)
+    // can be manipulated by attackers to inject malicious content.
+    if (isGaterEnabledFeature$LWS('changesSince.262') && isSameOriginURL$LWS(resourceUrl$LWS)) {
+      const parsedURL$LWS = parseURL$LWS(resourceUrl$LWS);
+      if (!isValidBrowsingContextURL$LWS(parsedURL$LWS)) {
+        throw new LockerSecurityError$LWS(`Cannot open disallowed endpoint: ${toSafeTemplateStringValue$LWS(parsedURL$LWS.normalizedURL)}`);
+      }
+    }
+    const childWindow$LWS = ReflectApply$LWS$1(originalWindowOpen$LWS, this, normalizedArgs$LWS);
+    if (!isGaterEnabledFeature$LWS('changesSince.262')) {
+      // istanbul ignore else: previous behavior will not be tested in collection coverage
+      if (isGaterEnabledFeature$LWS('changesSince.256')) {
+        if (isSameOriginURL$LWS(resourceUrl$LWS)) {
+          markForUnsafePropertyBlocking$LWS(childWindow$LWS);
+        }
+      } else {
         markForUnsafePropertyBlocking$LWS(childWindow$LWS);
       }
-    } else {
-      // When the gate is disabled, mark all child windows
-      markForUnsafePropertyBlocking$LWS(childWindow$LWS);
     }
     // W-14218118
     // If the target is '_self', '_parent', or '_top', only makes one request
@@ -10093,7 +11446,9 @@ function initDistortionWindowSetInterval$LWS({
     virtualEnvironmentEvaluator: virtualEnvironmentEvaluator$LWS
   }) {
     return [originalSetInterval$LWS, function setInterval$LWS(...args$LWS) {
-      throwIfMarkedAsUnsafeInChildWindow$LWS(virtualEnvironmentEvaluator$LWS, 'setInterval');
+      if (!isGaterEnabledFeature$LWS('changesSince.262')) {
+        throwIfMarkedAsUnsafeInChildWindow$LWS(virtualEnvironmentEvaluator$LWS, 'setInterval');
+      }
       if (args$LWS.length) {
         const {
           0: callback$LWS
@@ -10107,12 +11462,8 @@ function initDistortionWindowSetInterval$LWS({
               // Defer transforming source text asynchronously.
               sandboxEvaluator$LWS(transformSourceText$LWS(sourceText$LWS), UNCOMPILED_CONTEXT$LWS);
             };
-          } else {
-            if (isGaterEnabledFeature$LWS('changesSince.256') &&
-            // @ts-ignore callback and eval have different type defs, but that's ok for this condition
-            callback$LWS === eval) {
-              throw new LockerSecurityError$LWS('Cannot pass unsafe eval reference.');
-            }
+          } else if (isGaterEnabledFeature$LWS('changesSince.256')) {
+            throwIfUnsafeCallbackReference$LWS(callback$LWS);
           }
         }
       }
@@ -10131,7 +11482,9 @@ function initDistortionWindowSetTimeout$LWS({
     virtualEnvironmentEvaluator: virtualEnvironmentEvaluator$LWS
   }) {
     return [originalSetTimeout$LWS, function setTimeout$LWS(...args$LWS) {
-      throwIfMarkedAsUnsafeInChildWindow$LWS(virtualEnvironmentEvaluator$LWS, 'setTimeout');
+      if (!isGaterEnabledFeature$LWS('changesSince.262')) {
+        throwIfMarkedAsUnsafeInChildWindow$LWS(virtualEnvironmentEvaluator$LWS, 'setTimeout');
+      }
       if (args$LWS.length) {
         const {
           0: callback$LWS
@@ -10145,12 +11498,8 @@ function initDistortionWindowSetTimeout$LWS({
               // Defer transforming source text asynchronously.
               sandboxEvaluator$LWS(transformSourceText$LWS(sourceText$LWS), UNCOMPILED_CONTEXT$LWS);
             };
-          } else {
-            if (isGaterEnabledFeature$LWS('changesSince.256') &&
-            // @ts-ignore callback and eval have different type defs, but that's ok for this condition
-            callback$LWS === eval) {
-              throw new LockerSecurityError$LWS('Cannot pass unsafe eval reference.');
-            }
+          } else if (isGaterEnabledFeature$LWS('changesSince.256')) {
+            throwIfUnsafeCallbackReference$LWS(callback$LWS);
           }
         }
       }
@@ -10246,7 +11595,7 @@ function initDistortionXMLHttpRequestOpen$LWS({
     const url$LWS = args$LWS.length > 1 ? args$LWS[1] : undefined;
     if (url$LWS !== null && url$LWS !== undefined) {
       const parsedURL$LWS = parseURL$LWS(toSafeStringValue$LWS(url$LWS));
-      if (!isValidURL$LWS(parsedURL$LWS)) {
+      if (!isAllowedEndpointURL$LWS(parsedURL$LWS)) {
         throw new LockerSecurityError$LWS(`Cannot request disallowed endpoint: ${parsedURL$LWS.normalizedURL}`);
       }
       args$LWS[1] = parsedURL$LWS.normalizedURL;
@@ -10266,12 +11615,17 @@ function replaceDocumentContent$LWS(doc$LWS, content$LWS) {
 }
 function initDistortionXMLHttpRequestResponseGetter$LWS({
   document: document$LWS,
+  globalObject: globalObject$LWS,
   globalObject: {
     Document: Document$LWS,
     XMLHttpRequest: XMLHttpRequest$LWS
   }
 }) {
   const originalResponseGetter$LWS = ObjectLookupOwnGetter$LWS$1(XMLHttpRequest$LWS.prototype, 'response');
+  const {
+    isXMLEntityAttack: isXMLEntityAttack$LWS,
+    isXMLNamespacedScriptAttack: isXMLNamespacedScriptAttack$LWS
+  } = getValidator$LWS(document$LWS, globalObject$LWS);
   return function distortionXMLHttpRequestResponseGetter$LWS({
     key: key$LWS
   }) {
@@ -10285,6 +11639,9 @@ function initDistortionXMLHttpRequestResponseGetter$LWS({
       if (rawResponse$LWS instanceof Document$LWS) {
         const docEl$LWS = ReflectApply$LWS$1(DocumentProtoDocumentElementGetter$LWS, rawResponse$LWS, []);
         const content$LWS = ReflectApply$LWS$1(ElementProtoOuterHTMLGetter$LWS, docEl$LWS, []);
+        if (isGaterEnabledFeature$LWS('changesSince.262') && (isXMLEntityAttack$LWS(content$LWS) || isXMLNamespacedScriptAttack$LWS(content$LWS))) {
+          throw new LockerSecurityError$LWS(`Cannot access XMLHttpRequest response using an unsecure ${toSafeTemplateStringValue$LWS(rawResponse$LWS)}.`);
+        }
         return replaceDocumentContent$LWS(rawResponse$LWS, lwsInternalPolicy$LWS.createHTML(content$LWS, key$LWS, ContentType$LWS.HTML));
       }
       return rawResponse$LWS;
@@ -10293,11 +11650,16 @@ function initDistortionXMLHttpRequestResponseGetter$LWS({
 }
 function initDistortionXMLHttpRequestResponseXMLGetter$LWS({
   document: document$LWS,
+  globalObject: globalObject$LWS,
   globalObject: {
     XMLHttpRequest: XMLHttpRequest$LWS
   }
 }) {
   const originalResponseXMLGetter$LWS = ObjectLookupOwnGetter$LWS$1(XMLHttpRequest$LWS.prototype, 'responseXML');
+  const {
+    isXMLEntityAttack: isXMLEntityAttack$LWS,
+    isXMLNamespacedScriptAttack: isXMLNamespacedScriptAttack$LWS
+  } = getValidator$LWS(document$LWS, globalObject$LWS);
   return function distortionXMLHttpRequestResponseXMLGetter$LWS({
     key: key$LWS
   }) {
@@ -10310,6 +11672,9 @@ function initDistortionXMLHttpRequestResponseXMLGetter$LWS({
       setCustomElementsRegistry$LWS(document$LWS, key$LWS);
       const docEl$LWS = ReflectApply$LWS$1(DocumentProtoDocumentElementGetter$LWS, rawResponseXML$LWS, []);
       const content$LWS = ReflectApply$LWS$1(ElementProtoOuterHTMLGetter$LWS, docEl$LWS, []);
+      if (isGaterEnabledFeature$LWS('changesSince.262') && (isXMLEntityAttack$LWS(content$LWS) || isXMLNamespacedScriptAttack$LWS(content$LWS))) {
+        throw new LockerSecurityError$LWS(`Cannot access XMLHttpRequest responseXML using an unsecure ${toSafeTemplateStringValue$LWS(rawResponseXML$LWS)}.`);
+      }
       return replaceDocumentContent$LWS(rawResponseXML$LWS, lwsInternalPolicy$LWS.createHTML(content$LWS, key$LWS, ContentType$LWS.HTML));
     }];
   };
@@ -10329,29 +11694,35 @@ initDistortionBroadcastChannelPostMessage$LWS,
 // CSSStyleRule
 initDistortionCSSStyleRuleStyleGetter$LWS,
 // Document
-initDistortionDocumentDomainSetter$LWS, initDistortionDocumentOnsecuritypolicyviolation$LWS, initDistortionDocumentOpen$LWS,
+initDistortionDocumentCreateNodeIterator$LWS, initDistortionDocumentCreateTreeWalker$LWS, initDistortionDocumentDomainSetter$LWS, initDistortionDocumentOnsecuritypolicyviolation$LWS, initDistortionDocumentOpen$LWS,
 // Element
-initDistortionElementAttributesGetter$LWS, initDistortionElementGetInnerHTML$LWS, initDistortionElementRemove$LWS, initDistortionElementReplaceChildren$LWS, initDistortionElementReplaceWith$LWS,
+initDistortionElementAttributesGetter$LWS, initDistortionElementGetInnerHTML$LWS, initDistortionElementInnerHTMLGetter$LWS, initDistortionElementOuterHTMLGetter$LWS, initDistortionElementRemove$LWS, initDistortionElementReplaceChildren$LWS, initDistortionElementReplaceWith$LWS,
 // Function
 initDistortionFunction$LWS,
 // History
 initDistortionHistoryPushState$LWS, initDistortionHistoryReplaceState$LWS,
 // HTMLElement
-initDistortionHTMLElementDatasetGetter$LWS, initDistortionHTMLElementInnerTextSetter$LWS, initDistortionHTMLElementOuterTextSetter$LWS, initDistortionHTMLElementStyleGetter$LWS,
+initDistortionHTMLElementDatasetGetter$LWS, initDistortionHTMLElementInnerTextGetter$LWS, initDistortionHTMLElementInnerTextSetter$LWS, initDistortionHTMLElementOuterTextSetter$LWS, initDistortionHTMLElementStyleGetter$LWS,
 // HTMLIFrameElement
 initDistortionIFrameElementContentDocumentGetter$LWS, initDistortionIFrameElementContentWindowGetter$LWS, initDistortionHTMLIFrameElementSandboxGetter$LWS, initDistortionHTMLIFrameElementSandboxSetter$LWS, initDistortionHTMLIFrameElementSrcSetter$LWS,
 // HTMLLinkElement
 initDistortionHTMLLinkElementRelSetter$LWS, initDistortionHTMLLinkElementRelListSetter$LWS,
+// HTMLMetaElement
+initDistortionHTMLMetaElementContentGetter$LWS,
 // HTMLObjectElement
 initDistortionHTMLObjectElementDataSetter$LWS,
 // HTMLScriptElement
-initDistortionHTMLScriptElementSrcGetter$LWS, initDistortionHTMLScriptElementTextContentGetter$LWS, initDistortionHTMLScriptElementTextContentSetter$LWS, initDistortionHTMLScriptElementTextSetter$LWS,
+initDistortionHTMLScriptElementInnerTextGetter$LWS, initDistortionHTMLScriptElementSrcGetter$LWS, initDistortionHTMLScriptElementTextContentGetter$LWS, initDistortionHTMLScriptElementTextContentSetter$LWS, initDistortionHTMLScriptElementTextGetter$LWS, initDistortionHTMLScriptElementTextSetter$LWS,
 // IDBObjectStore
 initDistortionIDBObjectStoreAdd$LWS, initDistortionIDBObjectStorePut$LWS,
 // MessagePort
 initDistortionMessagePortPostMessage$LWS,
+// MutationObserver
+initDistortionMutationObserverObserve$LWS,
 // Navigator
 initDistortionNavigatorSendBeacon$LWS, initDistortionNavigatorServiceWorkerGetter$LWS,
+// Observable
+initDistortionObservableForEach$LWS, initDistortionObservableSubscribe$LWS,
 // Node
 initDistortionNodeRemoveChild$LWS, initDistortionNodeReplaceChild$LWS,
 // Performance
@@ -10359,19 +11730,21 @@ initDistortionPerformanceMark$LWS, initDistortionPerformanceMeasure$LWS,
 // PerformanceMark
 initDistortionPerformanceMarkCtor$LWS,
 // Promise
-initDistortionPromiseTry$LWS,
+initDistortionPromiseAll$LWS, initDistortionPromiseAllSettled$LWS, initDistortionPromiseAny$LWS, initDistortionPromiseCatch$LWS, initDistortionPromiseFinally$LWS, initDistortionPromiseRace$LWS, initDistortionPromiseReject$LWS, initDistortionPromiseResolve$LWS, initDistortionPromiseThen$LWS, initDistortionPromiseTry$LWS, initDistortionPromiseWithResolvers$LWS,
 // Notification
 initDistortionNotificationCtor$LWS,
 // Range
-initDistortionRangeDeleteContents$LWS, initDistortionRangeExtractContents$LWS, initDistortionRangeInsertNode$LWS, initDistortionRangeSelectNode$LWS, initDistortionRangeSelectNodeContents$LWS, initDistortionRangeSetEnd$LWS, initDistortionRangeSetEndAfter$LWS, initDistortionRangeSetEndBefore$LWS, initDistortionRangeSetStart$LWS, initDistortionRangeSetStartAfter$LWS, initDistortionRangeSetStartBefore$LWS, initDistortionRangeSurroundContents$LWS,
+initDistortionRangeCloneContents$LWS, initDistortionRangeCloneRange$LWS, initDistortionRangeDeleteContents$LWS, initDistortionRangeExtractContents$LWS, initDistortionRangeGetBoundingClientRect$LWS, initDistortionRangeInsertNode$LWS, initDistortionRangeSelectNode$LWS, initDistortionRangeSelectNodeContents$LWS, initDistortionRangeSetEnd$LWS, initDistortionRangeSetEndAfter$LWS, initDistortionRangeSetEndBefore$LWS, initDistortionRangeSetStart$LWS, initDistortionRangeSetStartAfter$LWS, initDistortionRangeSetStartBefore$LWS, initDistortionRangeSurroundContents$LWS, initDistortionRangeToString$LWS,
 // Selection
-initDistortionSelectionCollapse$LWS, initDistortionSelectionExtend$LWS, initDistortionSelectionSelectAllChildren$LWS, initDistortionSelectionSetBaseAndExtent$LWS, initDistortionSelectionSetPosition$LWS,
+initDistortionSelectionAnchorNodeGetter$LWS, initDistortionSelectionCollapse$LWS, initDistortionSelectionExtend$LWS, initDistortionSelectionFocusNodeGetter$LWS, initDistortionSelectionSelectAllChildren$LWS, initDistortionSelectionSetBaseAndExtent$LWS, initDistortionSelectionSetPosition$LWS, initDistortionSelectionToString$LWS,
 // ServiceWorkerContainer
 initDistortionServiceWorkerContainerProto$LWS,
 // SharedWorker
 initDistortionSharedWorkerCtor$LWS, initDistortionSharedWorkerProto$LWS,
 // Storage
 initDistortionStorage$LWS, initDistortionStorageClear$LWS, initDistortionStorageGetItem$LWS, initDistortionStorageKey$LWS, initDistortionStorageLength$LWS, initDistortionStorageRemoveItem$LWS, initDistortionStorageSetItem$LWS,
+// SVGAnimatedString
+initDistortionSVGAnimatedStringBaseValSetter$LWS,
 // SVGAnimateElement
 initDistortionSVGAnimateElementFromAttribute$LWS, initDistortionSVGAnimateElementToAttribute$LWS, initDistortionSVGAnimateElementValuesAttribute$LWS,
 // SVGElement
@@ -10383,7 +11756,7 @@ initDistortionSVGUseElementHrefAttribute$LWS, initDistortionSVGUseElementXlinkHr
 // TrustedTypePolicyFactory
 initDistortionTrustedTypePolicyFactoryCreatePolicy$LWS,
 // Window
-initDistortionWindowFetch$LWS, initDistortionWindowFetchLater$LWS, initDistortionWindowFramesGetter$LWS, initDistortionWindowGetComputedStyle$LWS, initDistortionWindowLengthGetter$LWS, initDistortionWindowOpen$LWS, initDistortionWindowPostMessage$LWS, initDistortionWindowStructuredClone$LWS,
+initDistortionWindowFetch$LWS, initDistortionWindowFetchLater$LWS, initDistortionWindowFramesGetter$LWS, initDistortionWindowGetComputedStyle$LWS, initDistortionWindowLengthGetter$LWS, initDistortionWindowNameGetter$LWS, initDistortionWindowNameSetter$LWS, initDistortionWindowOpen$LWS, initDistortionWindowPostMessage$LWS, initDistortionWindowStructuredClone$LWS,
 // Worker
 initDistortionWorkerCtor$LWS, initDistortionWorkerProto$LWS,
 // XHR
@@ -10404,21 +11777,33 @@ initDistortionDocumentCookieGetter$LWS, initDistortionDocumentCookieSetter$LWS,
 // DOMParser
 initDistortionDOMParserParseFromString$LWS,
 // Element
-initDistortionElementAttachShadow$LWS, initDistortionElementInnerHTMLSetter$LWS, initDistortionElementInsertAdjacentHTML$LWS, initDistortionElementOuterHTMLSetter$LWS, initDistortionElementSetAttribute$LWS, initDistortionElementSetAttributeNode$LWS, initDistortionElementSetAttributeNodeNS$LWS, initDistortionElementSetAttributeNS$LWS, initDistortionElementSetHTML$LWS, initDistortionElementSetHTMLUnsafe$LWS, initDistortionElementShadowRootGetter$LWS, initDistortionElementToggleAttribute$LWS,
+initDistortionElementAttachShadow$LWS, initDistortionElementInnerHTMLSetter$LWS, initDistortionElementInsertAdjacentHTML$LWS, initDistortionElementOuterHTMLSetter$LWS, initDistortionElementGetAttribute$LWS, initDistortionElementGetAttributeNode$LWS, initDistortionElementGetAttributeNodeNS$LWS, initDistortionElementGetAttributeNS$LWS, initDistortionElementSetAttribute$LWS, initDistortionElementSetAttributeNode$LWS, initDistortionElementSetAttributeNodeNS$LWS, initDistortionElementSetAttributeNS$LWS, initDistortionElementSetHTML$LWS, initDistortionElementSetHTMLUnsafe$LWS, initDistortionElementShadowRootGetter$LWS, initDistortionElementToggleAttribute$LWS,
 // Eval
 initDistortionEval$LWS,
 // Event
 initDistortionEventComposedPath$LWS, initDistortionEventPathGetter$LWS,
 // EventTarget
 initDistortionEventTargetAddEventListener$LWS,
+// HTMLAnchorElement
+initDistortionHTMLAnchorElementHrefSetter$LWS,
+// HTMLBaseElement
+initDistortionHTMLBaseElementHrefSetter$LWS,
 // HTMLBodyElement
 initDistortionHTMLBodyElementOnrejectionhandled$LWS, initDistortionHTMLBodyElementOnstorage$LWS, initDistortionHTMLBodyElementOnunhandledrejection$LWS,
 // HTMLElement
 initDistortionHTMLElementCtor$LWS, initDistortionHTMLElementOnsecuritypolicyviolation$LWS,
+// HTMLButtonElement
+initDistortionHTMLButtonElementFormActionSetter$LWS,
+// HTMLFormElement
+initDistortionHTMLFormElementActionSetter$LWS,
+// HTMLInputElement
+initDistortionHTMLInputElementFormActionSetter$LWS,
 // HTMLFrameSetElement
 initDistortionHTMLFrameSetElementOnrejectionhandled$LWS, initDistortionHTMLFrameSetElementOnstorage$LWS, initDistortionHTMLFrameSetElementOnunhandledrejection$LWS,
 // HTMLScriptElement,
 initDistortionHTMLScriptElementSrcSetter$LWS, initDistortionHTMLScriptElementTextSetter$LWS,
+// IDBFactory
+initDistortionIDBFactoryDatabases$LWS, initDistortionIDBFactoryDeleteDatabase$LWS, initDistortionIDBFactoryOpen$LWS,
 // MathMLElement
 initDistortionMathMLElementOnsecuritypolicyviolation$LWS,
 // NamedNodeMap
@@ -10454,7 +11839,7 @@ initDistortionElementAfter$LWS, initDistortionElementAppend$LWS, initDistortionE
 // initDistortionNodeAppendChild,
 initDistortionNodeInsertBefore$LWS]);
 const externalKeyedDistortionFactoryInitializers$LWS = internalKeyedDistortionFactoryInitializers$LWS;
-const distortionFactoryInitializerToggleSwitches$LWS = toSafeMap$LWS$1(new MapCtor$LWS$1([[initDistortionCacheStorageDelete$LWS, 'caches'], [initDistortionCacheStorageHas$LWS, 'caches'], [initDistortionCacheStorageKeys$LWS, 'caches'], [initDistortionCacheStorageMatch$LWS, 'caches'], [initDistortionCacheStorageOpen$LWS, 'caches'], [initDistortionCookieStoreDelete$LWS, 'cookieStore'], [initDistortionCookieStoreGet$LWS, 'cookieStore'], [initDistortionCookieStoreGetAll$LWS, 'cookieStore'], [initDistortionCookieStoreOnChange$LWS, 'cookieStore'], [initDistortionCookieStoreSet$LWS, 'cookieStore'], [initDistortionCSSStyleRuleStyleGetter$LWS, 'style'], [initDistortionCustomElementRegistryDefine$LWS, 'customElements'], [initDistortionCustomElementRegistryGet$LWS, 'customElements'], [initDistortionCustomElementRegistryUpgrade$LWS, 'customElements'], [initDistortionCustomElementRegistryWhenDefined$LWS, 'customElements'], [initDistortionDocumentCookieGetter$LWS, 'documentCookie'], [initDistortionDocumentCookieSetter$LWS, 'documentCookie'], [initDistortionDocumentDomainSetter$LWS, 'documentDomain'], [initDistortionDocumentExecCommand$LWS, 'documentExecCommand'], [initDistortionDOMParserParseFromString$LWS, 'domParserParseFromString'], [initDistortionElementAfter$LWS, 'element'], [initDistortionElementAppend$LWS, 'element'], [initDistortionElementAttributesGetter$LWS, 'attributes'], [initDistortionElementBefore$LWS, 'element'], [initDistortionElementGetInnerHTML$LWS, 'innerHTML'], [initDistortionElementInnerHTMLSetter$LWS, 'innerHTML'], [initDistortionElementInsertAdjacentElement$LWS, 'element'], [initDistortionElementInsertAdjacentHTML$LWS, 'element'], [initDistortionElementOuterHTMLSetter$LWS, 'element'], [initDistortionElementPrepend$LWS, 'element'], [initDistortionElementRemove$LWS, 'element'], [initDistortionElementReplaceChildren$LWS, 'element'], [initDistortionElementReplaceWith$LWS, 'element'], [initDistortionElementSetAttribute$LWS, 'attributes'], [initDistortionElementSetAttributeNode$LWS, 'attributes'], [initDistortionElementSetAttributeNodeNS$LWS, 'attributes'], [initDistortionElementSetAttributeNS$LWS, 'attributes'], [initDistortionElementSetHTML$LWS, 'element'], [initDistortionElementToggleAttribute$LWS, 'attributes'], [initDistortionHistoryPushState$LWS, 'history'], [initDistortionHistoryReplaceState$LWS, 'history'], [initDistortionHTMLElementDatasetGetter$LWS, 'dataset'], [initDistortionHTMLElementStyleGetter$LWS, 'style'], [initDistortionHTMLScriptElementSrcGetter$LWS, 'script'], [initDistortionHTMLScriptElementSrcSetter$LWS, 'script'], [initDistortionHTMLScriptElementTextSetter$LWS, 'script'], [initDistortionIDBObjectStoreAdd$LWS, 'indexedDB'], [initDistortionIDBObjectStorePut$LWS, 'indexedDB'], [initDistortionLocalStorage$LWS, 'storage'], [initDistortionMessagePortPostMessage$LWS, 'postMessage'], [initDistortionNamedNodeMapSetNamedItem$LWS, 'attributes'], [initDistortionNamedNodeMapSetNamedItemNS$LWS, 'attributes'], [initDistortionNavigatorSendBeacon$LWS, 'navigatorSendBeacon'], [initDistortionNodeInsertBefore$LWS, 'node'], [initDistortionNodeRemoveChild$LWS, 'node'], [initDistortionNodeReplaceChild$LWS, 'node'], [initDistortionNodeTextContentGetter$LWS, 'node'], [initDistortionNodeTextContentSetter$LWS, 'node'], [initDistortionNodeValueSetter$LWS, 'node'], [initDistortionNotificationCtor$LWS, 'notification'], [initDistortionPerformanceMark$LWS, 'performance'], [initDistortionPerformanceMarkCtor$LWS, 'performance'], [initDistortionPerformanceMeasure$LWS, 'performance'], [initDistortionRangeCreateContextualFragment$LWS, 'range'], [initDistortionRangeDeleteContents$LWS, 'range'], [initDistortionRangeExtractContents$LWS, 'range'], [initDistortionRangeInsertNode$LWS, 'range'], [initDistortionRangeSelectNode$LWS, 'range'], [initDistortionRangeSelectNodeContents$LWS, 'range'], [initDistortionRangeSetEnd$LWS, 'range'], [initDistortionRangeSetEndAfter$LWS, 'range'], [initDistortionRangeSetEndBefore$LWS, 'range'], [initDistortionRangeSetStart$LWS, 'range'], [initDistortionRangeSetStartAfter$LWS, 'range'], [initDistortionRangeSetStartBefore$LWS, 'range'], [initDistortionRangeSurroundContents$LWS, 'range'], [initDistortionSelectionCollapse$LWS, 'selection'], [initDistortionSelectionExtend$LWS, 'selection'], [initDistortionSelectionSelectAllChildren$LWS, 'selection'], [initDistortionSelectionSetBaseAndExtent$LWS, 'selection'], [initDistortionSelectionSetPosition$LWS, 'selection'], [initDistortionSessionStorage$LWS, 'storage'], [initDistortionShadowRootInnerHTMLSetter$LWS, 'innerHTML'], [initDistortionStorage$LWS, 'storage'], [initDistortionStorageClear$LWS, 'storage'], [initDistortionStorageGetItem$LWS, 'storage'], [initDistortionStorageKey$LWS, 'storage'], [initDistortionStorageLength$LWS, 'storage'], [initDistortionStorageRemoveItem$LWS, 'storage'], [initDistortionStorageSetItem$LWS, 'storage'], [initDistortionSVGElementDatasetGetter$LWS, 'dataset'], [initDistortionSVGElementStyleGetter$LWS, 'style'], [initDistortionSVGScriptElementHrefGetter$LWS, 'script'], [initDistortionSVGScriptElementHrefSetter$LWS, 'script'], [initDistortionWindowFetch$LWS, 'windowFetch'], [initDistortionWindowFetchLater$LWS, 'windowFetchLater'], [initDistortionWindowFramesGetter$LWS, 'windowFrames'], [initDistortionWindowGetComputedStyle$LWS, 'style'], [initDistortionWindowLengthGetter$LWS, 'windowFrames'], [initDistortionWindowPostMessage$LWS, 'postMessage'], [initDistortionWindowSetInterval$LWS, 'setInterval'], [initDistortionWindowSetTimeout$LWS, 'setTimeout'], [initDistortionXMLHttpRequestResponseGetter$LWS, 'xhr'], [initDistortionXMLHttpRequestResponseXMLGetter$LWS, 'xhr']]));
+const distortionFactoryInitializerToggleSwitches$LWS = toSafeMap$LWS$1(new MapCtor$LWS$1([[initDistortionCacheStorageDelete$LWS, 'caches'], [initDistortionCacheStorageHas$LWS, 'caches'], [initDistortionCacheStorageKeys$LWS, 'caches'], [initDistortionCacheStorageMatch$LWS, 'caches'], [initDistortionCacheStorageOpen$LWS, 'caches'], [initDistortionCookieStoreDelete$LWS, 'cookieStore'], [initDistortionCookieStoreGet$LWS, 'cookieStore'], [initDistortionCookieStoreGetAll$LWS, 'cookieStore'], [initDistortionCookieStoreOnChange$LWS, 'cookieStore'], [initDistortionCookieStoreSet$LWS, 'cookieStore'], [initDistortionCSSStyleRuleStyleGetter$LWS, 'style'], [initDistortionCustomElementRegistryDefine$LWS, 'customElements'], [initDistortionCustomElementRegistryGet$LWS, 'customElements'], [initDistortionCustomElementRegistryUpgrade$LWS, 'customElements'], [initDistortionCustomElementRegistryWhenDefined$LWS, 'customElements'], [initDistortionDocumentCookieGetter$LWS, 'documentCookie'], [initDistortionDocumentCookieSetter$LWS, 'documentCookie'], [initDistortionDocumentDomainSetter$LWS, 'documentDomain'], [initDistortionDocumentExecCommand$LWS, 'documentExecCommand'], [initDistortionDOMParserParseFromString$LWS, 'domParserParseFromString'], [initDistortionElementAfter$LWS, 'element'], [initDistortionElementAppend$LWS, 'element'], [initDistortionElementAttributesGetter$LWS, 'attributes'], [initDistortionElementBefore$LWS, 'element'], [initDistortionElementGetInnerHTML$LWS, 'innerHTML'], [initDistortionElementInnerHTMLSetter$LWS, 'innerHTML'], [initDistortionElementInsertAdjacentElement$LWS, 'element'], [initDistortionElementInsertAdjacentHTML$LWS, 'element'], [initDistortionElementOuterHTMLSetter$LWS, 'element'], [initDistortionElementPrepend$LWS, 'element'], [initDistortionElementRemove$LWS, 'element'], [initDistortionElementReplaceChildren$LWS, 'element'], [initDistortionElementReplaceWith$LWS, 'element'], [initDistortionElementGetAttribute$LWS, 'attributes'], [initDistortionElementGetAttributeNode$LWS, 'attributes'], [initDistortionElementGetAttributeNodeNS$LWS, 'attributes'], [initDistortionElementGetAttributeNS$LWS, 'attributes'], [initDistortionElementSetAttribute$LWS, 'attributes'], [initDistortionElementSetAttributeNode$LWS, 'attributes'], [initDistortionElementSetAttributeNodeNS$LWS, 'attributes'], [initDistortionElementSetAttributeNS$LWS, 'attributes'], [initDistortionElementSetHTML$LWS, 'element'], [initDistortionElementToggleAttribute$LWS, 'attributes'], [initDistortionHTMLButtonElementFormActionSetter$LWS, 'form'], [initDistortionHTMLFormElementActionSetter$LWS, 'form'], [initDistortionHTMLInputElementFormActionSetter$LWS, 'form'], [initDistortionHistoryPushState$LWS, 'history'], [initDistortionHistoryReplaceState$LWS, 'history'], [initDistortionHTMLElementDatasetGetter$LWS, 'dataset'], [initDistortionHTMLElementStyleGetter$LWS, 'style'], [initDistortionHTMLScriptElementInnerTextGetter$LWS, 'script'], [initDistortionHTMLScriptElementSrcGetter$LWS, 'script'], [initDistortionHTMLScriptElementSrcSetter$LWS, 'script'], [initDistortionHTMLScriptElementTextGetter$LWS, 'script'], [initDistortionHTMLScriptElementTextSetter$LWS, 'script'], [initDistortionIDBFactoryDatabases$LWS, 'indexedDB'], [initDistortionIDBFactoryDeleteDatabase$LWS, 'indexedDB'], [initDistortionIDBFactoryOpen$LWS, 'indexedDB'], [initDistortionIDBObjectStoreAdd$LWS, 'indexedDB'], [initDistortionIDBObjectStorePut$LWS, 'indexedDB'], [initDistortionLocalStorage$LWS, 'storage'], [initDistortionMessagePortPostMessage$LWS, 'postMessage'], [initDistortionMutationObserverObserve$LWS, 'mutationObserver'], [initDistortionNamedNodeMapSetNamedItem$LWS, 'attributes'], [initDistortionNamedNodeMapSetNamedItemNS$LWS, 'attributes'], [initDistortionNavigatorSendBeacon$LWS, 'navigatorSendBeacon'], [initDistortionObservableForEach$LWS, 'observable'], [initDistortionObservableSubscribe$LWS, 'observable'], [initDistortionNodeInsertBefore$LWS, 'node'], [initDistortionNodeRemoveChild$LWS, 'node'], [initDistortionNodeReplaceChild$LWS, 'node'], [initDistortionNodeTextContentGetter$LWS, 'node'], [initDistortionNodeTextContentSetter$LWS, 'node'], [initDistortionNodeValueSetter$LWS, 'node'], [initDistortionNotificationCtor$LWS, 'notification'], [initDistortionPerformanceMark$LWS, 'performance'], [initDistortionPerformanceMarkCtor$LWS, 'performance'], [initDistortionPerformanceMeasure$LWS, 'performance'], [initDistortionRangeCloneContents$LWS, 'range'], [initDistortionRangeCloneRange$LWS, 'range'], [initDistortionRangeCreateContextualFragment$LWS, 'range'], [initDistortionRangeDeleteContents$LWS, 'range'], [initDistortionRangeExtractContents$LWS, 'range'], [initDistortionRangeGetBoundingClientRect$LWS, 'range'], [initDistortionRangeInsertNode$LWS, 'range'], [initDistortionRangeSelectNode$LWS, 'range'], [initDistortionRangeSelectNodeContents$LWS, 'range'], [initDistortionRangeSetEnd$LWS, 'range'], [initDistortionRangeSetEndAfter$LWS, 'range'], [initDistortionRangeSetEndBefore$LWS, 'range'], [initDistortionRangeSetStart$LWS, 'range'], [initDistortionRangeSetStartAfter$LWS, 'range'], [initDistortionRangeSetStartBefore$LWS, 'range'], [initDistortionRangeSurroundContents$LWS, 'range'], [initDistortionRangeToString$LWS, 'range'], [initDistortionSelectionAnchorNodeGetter$LWS, 'selection'], [initDistortionSelectionCollapse$LWS, 'selection'], [initDistortionSelectionExtend$LWS, 'selection'], [initDistortionSelectionFocusNodeGetter$LWS, 'selection'], [initDistortionSelectionSelectAllChildren$LWS, 'selection'], [initDistortionSelectionSetBaseAndExtent$LWS, 'selection'], [initDistortionSelectionSetPosition$LWS, 'selection'], [initDistortionSelectionToString$LWS, 'selection'], [initDistortionSessionStorage$LWS, 'storage'], [initDistortionShadowRootInnerHTMLSetter$LWS, 'innerHTML'], [initDistortionStorage$LWS, 'storage'], [initDistortionStorageClear$LWS, 'storage'], [initDistortionStorageGetItem$LWS, 'storage'], [initDistortionStorageKey$LWS, 'storage'], [initDistortionStorageLength$LWS, 'storage'], [initDistortionStorageRemoveItem$LWS, 'storage'], [initDistortionStorageSetItem$LWS, 'storage'], [initDistortionSVGElementDatasetGetter$LWS, 'dataset'], [initDistortionSVGElementStyleGetter$LWS, 'style'], [initDistortionSVGAnimatedStringBaseValSetter$LWS, 'script'], [initDistortionSVGScriptElementHrefGetter$LWS, 'script'], [initDistortionSVGScriptElementHrefSetter$LWS, 'script'], [initDistortionWindowFetch$LWS, 'windowFetch'], [initDistortionWindowFetchLater$LWS, 'windowFetchLater'], [initDistortionWindowFramesGetter$LWS, 'windowFrames'], [initDistortionWindowGetComputedStyle$LWS, 'style'], [initDistortionWindowLengthGetter$LWS, 'windowFrames'], [initDistortionWindowNameGetter$LWS, 'windowName'], [initDistortionWindowNameSetter$LWS, 'windowName'], [initDistortionWindowPostMessage$LWS, 'postMessage'], [initDistortionWindowSetInterval$LWS, 'setInterval'], [initDistortionWindowSetTimeout$LWS, 'setTimeout'], [initDistortionXMLHttpRequestResponseGetter$LWS, 'xhr'], [initDistortionXMLHttpRequestResponseXMLGetter$LWS, 'xhr']]));
 const DocumentBlockedProperties$LWS = ['parseHTMLUnsafe'];
 const DocumentProtoBlockedProperties$LWS = ['createProcessingInstruction', 'exitFullscreen', 'fullscreen', 'fullscreenElement', 'fullscreenEnabled', 'mozCancelFullScreen', 'mozFullScreen', 'mozFullScreenElement', 'mozFullScreenEnabled', 'onfullscreenchange', 'onfullscreenerror', 'onmozfullscreenchange', 'onmozfullscreenerror', 'onrejectionhandled', 'onunhandledrejection', 'parseHTMLUnsafe', 'releaseCapture', 'releaseEvents', 'requestStorageAccess', 'webkitFullScreenKeyboardInputAllowed', 'write', 'writeln'];
 const ElementProtoBlockedProperties$LWS = ['mozRequestFullScreen', 'onfullscreenchange', 'onfullscreenerror', 'requestFullscreen', 'webkitRequestFullScreen', 'webkitRequestFullscreen'];
@@ -10474,7 +11859,7 @@ const SVGElementProtoBlockedProperties$LWS = ['nonce'];
 const UIEventProtoBlockedProperties$LWS = ['rangeParent'];
 const WindowBlockedProperties$LWS = ['find', 'requestFileSystem', 'webkitRequestFileSystem'];
 const XSLTProcessorProtoBlockedProperties$LWS = ['transformToDocument', 'transformToFragment'];
-/*! version: 0.26.4 */
+/*! version: 0.27.5 */
 
 /*!
  * Copyright (C) 2021 salesforce.com, inc.
@@ -10483,7 +11868,7 @@ let pdpSchema$LWS;
 function getPdpSchema$LWS() {
   return pdpSchema$LWS;
 }
-/*! version: 0.26.4 */
+/*! version: 0.27.5 */
 
 /*!
  * Copyright (C) 2019 salesforce.com, inc.
@@ -10682,15 +12067,10 @@ function createDistortionEntries$LWS(record$LWS, factories$LWS) {
         let distortionToggleSwitchWrapperOrProxyMaskedFunction$LWS = proxyMaskedFunctionDistortion$LWS;
         if (ENABLE_DISTORTION_TOGGLE_SWITCHES$LWS && toggleSwitchName$LWS) {
           distortionToggleSwitchWrapperOrProxyMaskedFunction$LWS = createDistortionToggleSwitchWrapper$LWS(record$LWS.key, toggleSwitchName$LWS, proxyMaskedFunctionDistortion$LWS, originalValue$LWS);
-          // If the distorted API originated in a window created via window.open or
-          // document.open, it may be marked as an unsafe property. If so, we need
-          // to transfer the original value's marker to the wrapped toggle switch
-          // function to ensure that the distortion itself can find the marker when
-          // checking if it needs to be blocked.
-          if (originalValue$LWS[CHILD_WINDOW_BLOCKED_PROPERTY_SYMBOL$LWS]) {
-            const descriptor$LWS = ReflectGetOwnPropertyDescriptor$LWS(originalValue$LWS, CHILD_WINDOW_BLOCKED_PROPERTY_SYMBOL$LWS);
-            ReflectDefineProperty$LWS$1(distortionToggleSwitchWrapperOrProxyMaskedFunction$LWS, CHILD_WINDOW_BLOCKED_PROPERTY_SYMBOL$LWS, descriptor$LWS);
-          }
+        }
+        if (!isGaterEnabledFeature$LWS('changesSince.262') && originalValue$LWS[CHILD_WINDOW_BLOCKED_PROPERTY_SYMBOL$LWS]) {
+          const descriptor$LWS = ReflectGetOwnPropertyDescriptor$LWS(originalValue$LWS, CHILD_WINDOW_BLOCKED_PROPERTY_SYMBOL$LWS);
+          ReflectDefineProperty$LWS$1(distortionToggleSwitchWrapperOrProxyMaskedFunction$LWS, CHILD_WINDOW_BLOCKED_PROPERTY_SYMBOL$LWS, descriptor$LWS);
         }
         entries$LWS[entries$LWS.length] = [originalValue$LWS, toggleSwitchName$LWS ? distortionToggleSwitchWrapperOrProxyMaskedFunction$LWS : proxyMaskedFunctionDistortion$LWS];
       } else {
@@ -15835,7 +17215,7 @@ function toSourceText$LWS(value$LWS, sourceType$LWS) {
   // tools from mistaking the regexp or the replacement string for an
   // actual source mapping URL.
   /\/\/# sandbox(?=MappingURL=.*?\s*$)/, '//# source']);
-  sourceText$LWS = `\n//# LWS Version = "0.26.4"\n${sourceText$LWS}`;
+  sourceText$LWS = `\n//# LWS Version = "0.27.5"\n${sourceText$LWS}`;
   return sourceType$LWS === 1 /* SourceType.Module */ && indexOfPragma$LWS(sourceText$LWS, 'use strict') === -1 ?
   // Append "'use strict'" to the extracted function body so it is
   // evaluated in strict mode.
@@ -15849,6 +17229,14 @@ const IFRAME_KEEP_ALIVE_FLAG$LWS = LOCKER_UNMINIFIED_FLAG$LWS$1 && !false;
 // created distortion map.
 const rootDistortionMapSeedEntries$LWS = [[rootDocument$LWS, rootDocument$LWS], [rootWindowLocation$LWS, rootWindowLocation$LWS], [rootWindow$LWS$1, rootWindow$LWS$1]];
 const seenGlobalObjects$LWS = toSafeWeakSet$LWS$1(new WeakSetCtor$LWS$1());
+// Tracks child windows and the last document for which distortions were
+// created. Unlike the non-iterable WeakSet above, this Map can be walked in
+// distortionCallback to eagerly detect navigations that the event-based
+// detection (unload → microtask → DOMContentLoaded) may have missed due to
+// timing: the microtask can run before the browser has replaced the document,
+// causing the check to bail out and the DOMContentLoaded listener to never be
+// attached.
+const childWindowDocuments$LWS = toSafeMap$LWS$1(new MapCtor$LWS$1());
 function createGetVirtualEnvironment$LWS(record$LWS) {
   let virtualEnvironment$LWS;
   return () => {
@@ -15947,9 +17335,73 @@ function createVirtualEnvironment$LWS(record$LWS) {
     distortionCallback(originalTarget$LWS) {
       const distortedTarget$LWS = distortions$LWS.get(originalTarget$LWS);
       if (distortedTarget$LWS) {
+        // The WindowProxy maintains identity across navigations, but
+        // each navigation replaces the inner window and all its
+        // realm-specific prototypes. Detect this by checking whether
+        // the WindowProxy's current document has been registered in
+        // the distortion map. If not, the inner window has been
+        // replaced and we must create a secondary sandbox record for
+        // the new realm before its undistorted prototypes can be
+        // reached by sandboxed code.
+        if (isGaterEnabledFeature$LWS('changesSince.262') && distortedTarget$LWS === originalTarget$LWS && seenGlobalObjects$LWS.has(originalTarget$LWS)) {
+          try {
+            const currentDoc$LWS = ReflectApply$LWS$1(WindowDocumentGetter$LWS, originalTarget$LWS, []);
+            if (!distortions$LWS.has(currentDoc$LWS)) {
+              createSecondaryWindowSandboxRecord$LWS({
+                context: EMPTY_OBJECT$LWS,
+                document: currentDoc$LWS,
+                globalObject: originalTarget$LWS,
+                key: key$LWS,
+                type: type$LWS
+              }, _root$LWS);
+            }
+          } catch (_unused1$LWS) {
+            // Cross-origin window — document access throws.
+            // Opaque sandbox record was already created on first
+            // encounter; nothing more to do.
+          }
+        }
         return distortedTarget$LWS;
       }
       if (typeof originalTarget$LWS === 'function') {
+        // When a child window navigates, the browser replaces the
+        // inner window and all its realm-specific built-ins (eval,
+        // Function, Document.prototype, etc.). Near-membrane caches
+        // the WindowProxy's proxy pointer, so distortionCallback is
+        // never re-invoked for the WindowProxy itself — but the NEW
+        // built-ins ARE seen as unknown objects here.  Walk the child
+        // window map and, for any window whose document has changed
+        // since we last created distortions, eagerly create a
+        // secondary sandbox record.  This populates the distortion
+        // map with entries for the new realm's objects so the
+        // re-lookup below can succeed.
+        if (isGaterEnabledFeature$LWS('changesSince.262') && childWindowDocuments$LWS.size > 0) {
+          for (const [childGlobalObject$LWS, lastDocument$LWS] of childWindowDocuments$LWS) {
+            // Only process child windows belonging to this
+            // sandbox (each sandbox has its own distortion map).
+            if (!distortions$LWS.has(childGlobalObject$LWS)) {
+              continue;
+            }
+            try {
+              const currentDoc$LWS = ReflectApply$LWS$1(WindowDocumentGetter$LWS, childGlobalObject$LWS, []);
+              if (currentDoc$LWS !== lastDocument$LWS) {
+                createSecondaryWindowSandboxRecord$LWS({
+                  context: EMPTY_OBJECT$LWS,
+                  document: currentDoc$LWS,
+                  globalObject: childGlobalObject$LWS,
+                  key: key$LWS,
+                  type: type$LWS
+                }, _root$LWS);
+                const newDistortedTarget$LWS = distortions$LWS.get(originalTarget$LWS);
+                if (newDistortedTarget$LWS) {
+                  return newDistortedTarget$LWS;
+                }
+              }
+            } catch (_unused35$LWS) {
+              // Cross-origin window — document access throws.
+            }
+          }
+        }
         return originalTarget$LWS;
       }
       // Perform the first own property check in a try-catch to avoid
@@ -15962,7 +17414,7 @@ function createVirtualEnvironment$LWS(record$LWS) {
         if (!ObjectHasOwn$LWS$1(originalTarget$LWS, 'location')) {
           return originalTarget$LWS;
         }
-      } catch (_unused1$LWS) {
+      } catch (_unused36$LWS) {
         // Likely an opaque object of a cross-origin window.
         // istanbul ignore next: an access of property iframe.contentWindow.location.href on an opaque window, that should reach this catch clause IS tested (see packages/integration-karma/test/distortions/HTMLIFrameElement/untrusted/snippets.js, "doesNotThrowOnCreationOrAccessOfCrossOriginIframeContentWindow"), but reported as uncovered
         return originalTarget$LWS;
@@ -15978,7 +17430,7 @@ function createVirtualEnvironment$LWS(record$LWS) {
           // not a window object, or if it is an opaque cross-origin window.
           originalTargetDocument$LWS = ReflectApply$LWS$1(WindowDocumentGetter$LWS, originalTarget$LWS, []);
           originalTargetWindow$LWS = originalTarget$LWS;
-        } catch (_unused35$LWS) {
+        } catch (_unused37$LWS) {
           try {
             // istanbul ignore else: current tests have no way of expressing a state that would cause this condition to evaluate false
             if (ReflectApply$LWS$1(WindowLocationGetter$LWS, originalTarget$LWS, [])) {
@@ -15990,7 +17442,7 @@ function createVirtualEnvironment$LWS(record$LWS) {
               return originalTarget$LWS;
             }
             // eslint-disable-next-line no-empty
-          } catch (_unused36$LWS) {}
+          } catch (_unused38$LWS) {}
         }
         // Check if originalTarget is a document and get its defaultView.
       } else if ('defaultView' in originalTarget$LWS) {
@@ -16004,7 +17456,7 @@ function createVirtualEnvironment$LWS(record$LWS) {
           // This will throw if `originalTarget` is not a document object.
           defaultView$LWS = ReflectApply$LWS$1(DocumentProtoDefaultViewGetter$LWS, originalTarget$LWS, []);
           // eslint-disable-next-line no-empty
-        } catch (_unused37$LWS) {}
+        } catch (_unused39$LWS) {}
         if (defaultView$LWS) {
           originalTargetDocument$LWS = originalTarget$LWS;
           originalTargetWindow$LWS = defaultView$LWS;
@@ -16240,6 +17692,7 @@ function createSecondaryWindowSandboxRecord$LWS({
   // virtual environment distortion callback by adding them to the root window's
   // distortion map.
   distortions$LWS.set(document$LWS, document$LWS);
+  childWindowDocuments$LWS.set(globalObject$LWS, document$LWS);
   distortions$LWS.set(location$LWS, location$LWS);
   const seenGlobalObject$LWS = seenGlobalObjects$LWS.has(globalObject$LWS);
   if (!seenGlobalObject$LWS) {
@@ -16293,7 +17746,7 @@ function createSecondaryWindowSandboxRecord$LWS({
           type: type$LWS
         }, _root$LWS);
       }
-    } catch (_unused38$LWS) {
+    } catch (_unused40$LWS) {
       // istanbul ignore next: this is a safety precaution that is unreachable via tests
       createOpaqueSecondaryWindowSandboxRecord$LWS({
         globalObject: globalObject$LWS,
@@ -16332,7 +17785,7 @@ function createSecondaryWindowSandboxRecord$LWS({
           ReflectApply$LWS$1(EventTargetProtoAddEventListener$LWS, globalObject$LWS, ['DOMContentLoaded', onDOMContentLoadedOrWindowLoad$LWS, true]);
           // istanbul ignore next: currently unreachable via tests
           ReflectApply$LWS$1(EventTargetProtoAddEventListener$LWS, globalObject$LWS, ['unload', onWindowUnload$LWS, true]);
-        } catch (_unused39$LWS) {
+        } catch (_unused41$LWS) {
           // istanbul ignore next: this is a safety precaution that is unreachable via tests
           createOpaqueSecondaryWindowSandboxRecord$LWS({
             globalObject: globalObject$LWS,
@@ -16558,7 +18011,7 @@ function wrapPlatformResourceLoader$LWS(dep$LWS, key$LWS) {
   depRegistry$LWS.set(dep$LWS, secureDep$LWS);
   return secureDep$LWS;
 }
-/*! version: 0.26.4 */
+/*! version: 0.27.5 */
 
 const loaderDefine = (globalThis ).LWR.define;