This fixes a CSP nonce disclosure (leading to a CSP bypass) caused by attribute merging on duplicate body/html tags. Per the HTML spec, once a nonce-bearing element is connected to the document the user agent must HIDE the nonce: it moves the value into the element’s internal [[nonce]] field and clears the content attribute, so scripts can only read the nonce via the .nonce IDL property and cannot exfiltrate it through side channels such as CSS attribute selectors. The spec also says that when the parser encounters a duplicate body or html tag it merges the duplicate element’s attributes onto the original (already-connected) element. HTMLConstructionSite::mergeAttributesFromTokenIntoElement performed that merge without nonce-specific handling, so it could copy a nonce content attribute from a duplicate body/html onto the original element after the original had already passed its hide-on-connect step — re-exposing the nonce as a live, readable attribute. An attacker who injects markup (but cannot yet run script) can then read the nonce through a CSS attribute selector such as body[nonce*=secret] (using attribute-substring matching plus resource-loading/timing side channels) to recover the per-response CSP nonce, and then inject a script element carrying the stolen nonce — defeating a nonce-based Content Security Policy.

The fix special-cases the nonce attribute during the merge: if the original element’s [[nonce]] internal field is already set it discards the duplicate’s nonce attribute; if the original has no nonce it merges the attribute and immediately runs the hide logic so the nonce is moved to [[nonce]] and cleared.

The restored invariant is that a nonce is never left exposed as a readable attribute on a connected element after attribute merging. The regression tests use duplicate body and html tags with a CSS attribute selector on nonce and a nonce-gated script under a nonce-based CSP.

A CSP nonce disclosure and consequent nonce-CSP bypass in the WebContent process, with no memory corruption. Recovering the nonce lets an attacker who can inject markup escalate to executing scripts a nonce-based CSP should block — turning a markup-injection foothold into an XSS-mitigation bypass. Reach depends on sites using nonce-based CSP, but for those it defeats a primary defense.