In some cases removing HTML elements during sanitization would keep existing SVG event handlers and therefore lead to XSS. This vulnerability affects Firefox < 83 Firefox ESR < 78.5 and Thunderbird < 78.5.