An element parsed with the customelementregistry attribute should get a null custom element registry. innerHTML gives it the global registry when the markup is simple enough for the fast-path parser, for example only built-in elements. When the full parser runs, for example because the markup contains a custom element name, it correctly gets null, as it does with setHTMLUnsafe. Example: const container = document.createElement('div'); container.innerHTML = '<div customelementregistry></div>'; container.firstChild.customElementRegistry; // expected null; actual: the global registry container.innerHTML = '<div customelementregistry><x-a></x-a></div>'; container.firstChild.customElementRegistry; // null, correctly Repro: https://codepen.io/editor/Steve-Orvell/pen/01a0feea-f951-796a-ac95-736667cfe103 Spec: https://github.com/whatwg/html/pull/12000 (renames the attribute scopedcustomelementregistry), DOM side: https://github.com/whatwg/dom/pull/1500 Same bug in Chromium: https://issues.chromium.org/issues/568822825