demo · v138
Attribute serialization escapes < and &
Type into the input. Two columns serialise the same element via .outerHTML — one shows the current Chrome behaviour, the other shows the pre-138 output (recreated). Watch < and & get encoded so round-tripping never silently produces injected markup.
checking support…
Pre-138 (recreated)
—
< and & were left raw → round-trip could mutate.
Chrome 138 outerHTML
—
checking…
round-trip probe
// In Chrome 138+, the attribute is re-parseable to the exact same value:
const el = document.createElement("div");
el.setAttribute("data-x", 'hello <world> & "friends"');
const wrap = document.createElement("div");
wrap.appendChild(el);
const parsed = new DOMParser().parseFromString(wrap.innerHTML, "text/html");
parsed.querySelector("div div").getAttribute("data-x") === el.getAttribute("data-x");
// true in 138+. False if & was left raw.