From b66b5ebe163650d8f86f091d7f489696252d254b Mon Sep 17 00:00:00 2001
From: juliecheng <julie.cheng@pendo.io>
Date: Mon, 16 Mar 2026 15:32:13 -0400
Subject: [PATCH] fix: treat querySelector/querySelectorAll as methods in
 untainted prototype check

---
 .changeset/sharp-lies-hear.md | 5 +++++
 packages/utils/src/index.ts   | 8 ++++----
 2 files changed, 9 insertions(+), 4 deletions(-)
 create mode 100644 .changeset/sharp-lies-hear.md

diff --git a/.changeset/sharp-lies-hear.md b/.changeset/sharp-lies-hear.md
new file mode 100644
index 0000000000..19fe0e26e7
--- /dev/null
+++ b/.changeset/sharp-lies-hear.md
@@ -0,0 +1,5 @@
+---
+"@rrweb/utils": patch
+---
+
+Move native Element querySelector and querySelector checks to testableMethods since they are methods
diff --git a/packages/utils/src/index.ts b/packages/utils/src/index.ts
index 84106ca6c5..bb5a036371 100644
--- a/packages/utils/src/index.ts
+++ b/packages/utils/src/index.ts
@@ -21,14 +21,14 @@ const testableAccessors = {
     'ownerDocument',
   ] as const,
   ShadowRoot: ['host', 'styleSheets'] as const,
-  Element: ['shadowRoot', 'querySelector', 'querySelectorAll'] as const,
+  Element: ['shadowRoot'] as const,
   MutationObserver: [] as const,
 } as const;
 
 const testableMethods = {
   Node: ['contains', 'getRootNode'] as const,
   ShadowRoot: ['getSelection'],
-  Element: [],
+  Element: ['querySelector', 'querySelectorAll'],
   MutationObserver: ['constructor'],
 } as const;
 
@@ -218,14 +218,14 @@ export function shadowRoot(n: Node): ShadowRoot | null {
 }
 
 export function querySelector(n: Element, selectors: string): Element | null {
-  return getUntaintedAccessor('Element', n, 'querySelector')(selectors);
+  return getUntaintedMethod('Element', n, 'querySelector')(selectors);
 }
 
 export function querySelectorAll(
   n: Element,
   selectors: string,
 ): NodeListOf<Element> {
-  return getUntaintedAccessor('Element', n, 'querySelectorAll')(selectors);
+  return getUntaintedMethod('Element', n, 'querySelectorAll')(selectors);
 }
 
 export function mutationObserverCtor(): (typeof MutationObserver)['prototype']['constructor'] {