CVE-2026-83611: xmldom: Parser silently accepts a not-well-formed end tag whose name is followed by a line break and trailing content

xmldom’s parser silently accepts a not-well-formed end tag whose valid name is followed by trailing content — e.g. </a⏎junk>. The element is closed, the trailing content is discarded, and no error is reported, even though the XML end-tag production allows only optional whitespace after the name and both Chromium and Firefox reject such input as application/xml. An application that relies on xmldom to reject not-well-formed input therefore receives a false “valid” result for a document the specification and browsers consider malformed.