CVE-2026-118244 — Highcharts Core: DOMParser fallback assigns unsanitized markup to innerHTML during print

A vulnerability in Highcharts Core causes raw markup to be assigned to an element’s innerHTML when DOMParser fails, before the allow-list is applied. In Chromium, this can occur during printing when the hosting page re-renders the chart from a beforeprint handler. If the conditions are met, event handlers from untrusted data can execute in the origin of the page hosting the chart.