v8::Local<v8::Value> PrivateScriptRunner::runDOMMethod(
    ScriptState* scriptState,
    ScriptState* scriptStateInUserScript,
    const char* className,
    const char* methodName,
    v8::Local<v8::Value> holder,
    int argc,
    v8::Local<v8::Value> argv[]) {
  v8::Local<v8::Object> classObject =
      classObjectOfPrivateScript(scriptState, className);
  v8::Local<v8::Value> method;
  if (!classObject
           ->Get(scriptState->context(),
                 v8String(scriptState->isolate(), methodName))
           .ToLocal(&method) ||
      !method->IsFunction()) {
    LOG(FATAL)
        << "Private script error: Target DOM method was not found. (Class "
           "name = "
        << className << ", Method name = " << methodName << ")";
  }
  initializeHolderIfNeeded(scriptState, classObject, holder);
  v8::TryCatch block(scriptState->isolate());
  v8::Local<v8::Value> result;
  if (!V8ScriptRunner::callInternalFunction(
           v8::Local<v8::Function>::Cast(method), holder, argc, argv,
           scriptState->isolate())
           .ToLocal(&result)) {
    rethrowExceptionInPrivateScript(
        scriptState->isolate(), block, scriptStateInUserScript,
        ExceptionState::ExecutionContext, methodName, className);
    block.ReThrow();
    return v8::Local<v8::Value>();
  }
  return result;
}

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.