326252 2026-10-04 05:00:30 -0700 innerHTML ignores the customelementregistry attribute when the fast-path parser handles the markup 2026-10-11 05:01:16 -0700 1 1 1 Unclassified WebKit New Bugs WebKit Nightly Build All All NEW InRadar P2 Normal --- 1 steveorvell webkit-unassigned webkit-bug-importer oldest_to_newest 2258473 0 steveorvell 2026-10-04 05:00:30 -0700 An element parsed with the customelementregistry attribute should get a null custom element registry. innerHTML gives it the global registry when the markup is simple enough for the fast-path parser, for example only built-in elements. When the full parser runs, for example because the markup contains a custom element name, it correctly gets null, as it does with setHTMLUnsafe. Example: const container = document.createElement('div'); container.innerHTML = '<div customelementregistry></div>'; container.firstChild.customElementRegistry; // expected null; actual: the global registry container.innerHTML = '<div customelementregistry><x-a></x-a></div>'; container.firstChild.customElementRegistry; // null, correctly Repro: https://codepen.io/editor/Steve-Orvell/pen/01a0feea-f951-796a-ac95-736667cfe103 Spec: https://github.com/whatwg/html/pull/12000 (renames the attribute scopedcustomelementregistry), DOM side: https://github.com/whatwg/dom/pull/1500 Same bug in Chromium: https://issues.chromium.org/issues/568822825 2261403 1 steveorvell 2026-10-09 07:09:41 -0700 Note, this issue also occurs using `setHTMLUnsafe`. 2262113 2 webkit-bug-importer 2026-10-11 05:01:16 -0700 <rdar://problem/189743339>