diff --git a/dom/security/sanitizer/Sanitizer.cpp b/dom/security/sanitizer/Sanitizer.cpp
index 403bf6fbecc..eed9ed94130 100644
--- a/dom/security/sanitizer/Sanitizer.cpp
+++ b/dom/security/sanitizer/Sanitizer.cpp
@@ -1630,6 +1630,7 @@ bool Sanitizer::SetDataAttributes(bool aAllow) {
 // https://wicg.github.io/sanitizer-api/#built-in-safe-baseline-configuration
 // The built-in safe baseline configuration
 #define FOR_EACH_BASELINE_REMOVE_ELEMENT(ELEMENT) \
+  ELEMENT(XHTML, xhtml, base)                     \
   ELEMENT(XHTML, xhtml, embed)                    \
   ELEMENT(XHTML, xhtml, frame)                    \
   ELEMENT(XHTML, xhtml, iframe)                   \
@@ -1762,8 +1763,7 @@ static bool RemoveJavascriptNavigationURLAttribute(Element* aElement,
   // Step 1. If «[elementName, attrName]» matches an entry in the built-in
   // navigating URL attributes list, and if attribute contains a javascript:
   // URL, then remove attribute from child.
-  if ((aElement->IsAnyOfHTMLElements(nsGkAtoms::a, nsGkAtoms::area,
-                                     nsGkAtoms::base) &&
+  if ((aElement->IsAnyOfHTMLElements(nsGkAtoms::a, nsGkAtoms::area) &&
        aLocalName == nsGkAtoms::href && aNamespaceID == kNameSpaceID_None) ||
       (aElement->IsAnyOfHTMLElements(nsGkAtoms::button, nsGkAtoms::input) &&
        aLocalName == nsGkAtoms::formaction &&
diff --git a/testing/web-platform/meta/sanitizer-api/sanitizer-javascript-url.html.ini b/testing/web-platform/meta/sanitizer-api/sanitizer-javascript-url.html.ini
new file mode 100644
index 00000000000..2a43dc3811d
--- /dev/null
+++ b/testing/web-platform/meta/sanitizer-api/sanitizer-javascript-url.html.ini
@@ -0,0 +1,6 @@
+[sanitizer-javascript-url.html]
+  [setHTML testcase built-in-navigating-url-attributes-list/2, "<base href="javascript:alert(1)"></base>"]
+    expected: FAIL
+
+  [parseHTML testcase built-in-navigating-url-attributes-list/2, "<base href="javascript:alert(1)"></base>"]
+    expected: FAIL
diff --git a/testing/web-platform/meta/sanitizer-api/sanitizer-removeUnsafe.html.ini b/testing/web-platform/meta/sanitizer-api/sanitizer-removeUnsafe.html.ini
new file mode 100644
index 00000000000..79b34a636f4
--- /dev/null
+++ b/testing/web-platform/meta/sanitizer-api/sanitizer-removeUnsafe.html.ini
@@ -0,0 +1,3 @@
+[sanitizer-removeUnsafe.html]
+  [removeUnsafe removes the right elements and attributes]
+    expected: FAIL

diff --git a/testing/web-platform/meta/sanitizer-api/sanitizer-javascript-url.html.ini b/testing/web-platform/meta/sanitizer-api/sanitizer-javascript-url.html.ini
new file mode 100644
index 00000000000..2a43dc3811d
--- /dev/null
+++ b/testing/web-platform/meta/sanitizer-api/sanitizer-javascript-url.html.ini
@@ -0,0 +1,6 @@
+[sanitizer-javascript-url.html]
+  [setHTML testcase built-in-navigating-url-attributes-list/2, "<base href="javascript:alert(1)"></base>"]
+    expected: FAIL
+
+  [parseHTML testcase built-in-navigating-url-attributes-list/2, "<base href="javascript:alert(1)"></base>"]
+    expected: FAIL
diff --git a/testing/web-platform/meta/sanitizer-api/sanitizer-removeUnsafe.html.ini b/testing/web-platform/meta/sanitizer-api/sanitizer-removeUnsafe.html.ini
new file mode 100644
index 00000000000..79b34a636f4
--- /dev/null
+++ b/testing/web-platform/meta/sanitizer-api/sanitizer-removeUnsafe.html.ini
@@ -0,0 +1,3 @@
+[sanitizer-removeUnsafe.html]
+  [removeUnsafe removes the right elements and attributes]
+    expected: FAIL