diff --git a/source b/source
index df3f20d06df..e2988e40161 100644
--- a/source
+++ b/source
@@ -2225,6 +2225,7 @@ a.setAttribute('href', 'https://example.com/'); // change the content attribute
      <li><dfn data-x-href="https://infra.spec.whatwg.org/#scalar-value-string">scalar value string</dfn></li>
      <li><dfn data-x-href="https://infra.spec.whatwg.org/#javascript-string-convert">convert</dfn></li>
      <li><dfn data-x-href="https://infra.spec.whatwg.org/#ascii-string">ASCII string</dfn></li>
+     <li><dfn data-x-href="https://infra.spec.whatwg.org/#ascii-tab-or-newline">ASCII tab or newline</dfn></li>
      <li><dfn id="space-characters" data-x-href="https://infra.spec.whatwg.org/#ascii-whitespace">ASCII whitespace</dfn></li>
      <li><dfn data-x-href="https://infra.spec.whatwg.org/#control">control</dfn></li>
      <li><dfn data-x="ASCII digits" data-x-href="https://infra.spec.whatwg.org/#ascii-digit">ASCII digit</dfn></li>
@@ -14743,18 +14744,28 @@ interface <dfn interface>HTMLBaseElement</dfn> : <span>HTMLElement</span> {
   data-x="attr-base-target">target</code> attributes, all but the first are ignored.</p>
 
   <p>To <dfn>get an element's target</dfn>, given an <code>a</code>, <code>area</code>, or
-  <code>form</code> element <var>element</var>, run these steps:
+  <code>form</code> element <var>element</var>, and an optional string-or-null <var>target</var>
+  (default null), run these steps:
 
   <ol>
-   <li><p>If <var>element</var> has a <code data-x="">target</code> attribute, then return that
-   attribute's value.</p></li>
+   <li>
+    <p>If <var>target</var> is null, then:</p>
 
-   <li><p>If <var>element</var>'s <span>node document</span> contains a <code>base</code> element
-   with a <code data-x="attr-base-target">target</code> attribute, then return the value of the
-   <code data-x="attr-base-target">target</code> attribute of the first such <code>base</code>
-   element.</p></li>
+    <ol>
+     <li><p>If <var>element</var> has a <code data-x="">target</code> attribute, then set
+     <var>target</var> to that attribute's value.</p></li>
 
-   <li><p>Return the empty string.</p></li>
+     <li><p>Otherwise, if <var>element</var>'s <span>node document</span> contains a
+     <code>base</code> element with a <code data-x="attr-base-target">target</code> attribute, set
+     <var>target</var> to the value of the <code data-x="attr-base-target">target</code> attribute
+     of the first such <code>base</code> element.</p></li>
+    </ol>
+   </li>
+
+   <li><p>If <var>target</var> is not null, and contains an <span>ASCII tab or newline</span> and a
+   U+003C (&lt;), then set <var>target</var> to "<code data-x="">_blank</code>".</p></li>
+
+   <li><p>Return <var>target</var>.</p></li>
   </ol>
 
   <hr>
@@ -58949,11 +58960,16 @@ fur
    <li><p>Let <var>enctype</var> be the <var>submitter</var> element's <span
    data-x="concept-fs-enctype">enctype</span>.</p></li>
 
-   <li><p>Let <var>target</var> be the <var>submitter</var> element's <code
-   data-x="attr-fs-formtarget">formtarget</code> attribute value, if the element is a <span
-   data-x="concept-submit-button">submit button</span> and has such an attribute. Otherwise, let it
-   be the result of <span data-x="get an element's target">getting an element's target</span> given
-   <var>submitter</var>'s <span>form owner</span>.</p></li>
+   <li><p>Let <var>formTarget</var> be null.</p></li>
+
+   <li><p>If the <var>submitter</var> element is a <span data-x="concept-submit-button">submit
+   button</span> and it has a <code data-x="attr-fs-formtarget">formtarget</code> attribute, then
+   set <var>formTarget</var> to the <code data-x="attr-fs-formtarget">formtarget</code> attribute
+   value.</p></li>
+
+   <li><p>Let <var>target</var> be the result of <span data-x="get an element's target">getting an
+   element's target</span> given <var>submitter</var>'s <span>form owner</span> and
+   <var>formTarget</var>.</p></li>
 
    <li><p>Let <var>noopener</var> be the result of <span data-x="get an element's noopener">getting
    an element's noopener</span> with <var>form</var> and <var>target</var>.</p></li>
@@ -93862,9 +93878,10 @@ interface <dfn interface>BeforeUnloadEvent</dfn> : <span>Event</span> {
   data-x="attr-hyperlink-target">target</code> attribute) to target <span
   data-x="navigate">navigations</span> at that navigable.</p>
 
-  <p id="valid-browsing-context-name">A <dfn>valid navigable target name</dfn> is any string with
-  at least one character that does not start with a U+005F LOW LINE character. (Names starting with
-  an underscore are reserved for special keywords.)</p>
+  <p id="valid-browsing-context-name">A <dfn>valid navigable target name</dfn> is any string with at
+  least one character that does not contain both an <span>ASCII tab or newline</span> and a U+003C
+  (&lt;), and it does not start with a U+005F (_). (Names starting with a U+005F (_) are reserved
+  for special keywords.)</p>
 
   <p id="valid-browsing-context-name-or-keyword">A <dfn>valid navigable target name or
   keyword</dfn> is any string that is either a <span>valid navigable target name</span> or that is