tl;dr charset confusion - validator bot uses data url where report bot loads over network. You can make a document that is interpreted as different charsets and thus different documents in the two contexts.

See [https://blog.bawolff.net/2024/09/sekaictf-2024-htmlsandbox.html](https://blog.bawolff.net/2024/09/sekaictf-2024-htmlsandbox.html) for full details

Original writeup (https://blog.bawolff.net/2024/09/sekaictf-2024-htmlsandbox.html).