Bypassing DOMPurify with mXSS

DOMPurify is the gold standard for client-side HTML sanitization. However, mutation XSS (mXSS) exploits browser parsing quirks to bypass sanitizers.

The key insight is that HTML parsed by the sanitizer may be re-parsed differently by the browser when inserted into the DOM.