diff --git a/src/browser/dom/element.zig b/src/browser/dom/element.zig
index 5e94079e..35153b73 100644
--- a/src/browser/dom/element.zig
+++ b/src/browser/dom/element.zig
@@ -633,6 +633,7 @@ test "Browser.DOM.Element" {
         .{ "a.hasAttribute('foo')", "true" },
         .{ "a.getAttribute('foo')", "bar" },
         .{ "a.getAttributeNames()", "id,foo" },
+        .{ " try { a.setAttribute('.foo', 'invalid') } catch (e) { e }", "Error: InvalidCharacterError" },
 
         .{ "a.setAttribute('foo', 'baz')", "undefined" },
         .{ "a.hasAttribute('foo')", "true" },
@@ -832,4 +833,11 @@ test "Browser.DOM.Element" {
         .{ "rm.remove()", "undefined" },
         .{ "document.getElementById('to-remove') != null", "false" },
     }, .{});
+
+    try runner.testCases(&.{
+        .{ "const div2 = document.createElement('div');", null },
+        .{ "div2.innerHTML = '<p id=1 .lit$id=9>a</p>';", null },
+        .{ "div2.innerHTML", "<p id=\"1\" .lit$id=\"9\">a</p>" },
+        .{ "div2.childNodes[0].getAttributeNames()", "id,.lit$id" },
+    }, .{});
 }
diff --git a/src/browser/netsurf.zig b/src/browser/netsurf.zig
index 72eedee7..5f6ce264 100644
--- a/src/browser/netsurf.zig
+++ b/src/browser/netsurf.zig
@@ -1633,9 +1633,14 @@ pub fn elementGetAttributeNS(elem: *Element, ns: []const u8, name: []const u8) !
 }
 
 pub fn elementSetAttribute(elem: *Element, qname: []const u8, value: []const u8) !void {
+    const dom_str = try strFromData(qname);
+    if (!c._dom_validate_name(dom_str)) {
+        return error.InvalidCharacterError;
+    }
+
     const err = elementVtable(elem).dom_element_set_attribute.?(
         elem,
-        try strFromData(qname),
+        dom_str,
         try strFromData(value),
     );
     try DOMErr(err);
@@ -1647,10 +1652,15 @@ pub fn elementSetAttributeNS(
     qname: []const u8,
     value: []const u8,
 ) !void {
+    const dom_str = try strFromData(qname);
+    if (!c._dom_validate_name(dom_str)) {
+        return error.InvalidCharacterError;
+    }
+
     const err = elementVtable(elem).dom_element_set_attribute_ns.?(
         elem,
         try strFromData(ns),
-        try strFromData(qname),
+        dom_str,
         try strFromData(value),
     );
     try DOMErr(err);
diff --git a/vendor/netsurf/libdom b/vendor/netsurf/libdom
index 16a0d916..0c590b26 160000
--- a/vendor/netsurf/libdom
+++ b/vendor/netsurf/libdom
@@ -1 +1 @@
-Subproject commit 16a0d9168473c5521519c240c1f2aabf8f74cef1
+Subproject commit 0c590b265a65b937042d68ad34902c9b4a05839a