Lightning Web Security setting changes behavior of custom (non-published) attributes on lightning-icon base component

The same code of LWC Html

<template>
        <div>
            <lightning-icon icon-name="utility:favorite" value="1" onclick={handleIconClick}></lightning-icon>
            <lightning-icon icon-name="utility:favorite" value="2" onclick={handleIconClick}></lightning-icon>
            <lightning-icon icon-name="utility:favorite" value="3" onclick={handleIconClick}></lightning-icon>
        </div>
        <p>Clicked value: {clickedIconValue}</p>
</template>

and Javascript

import { LightningElement } from 'lwc';

export default class WebSecurity extends LightningElement {
    clickedIconValue;
    handleIconClick(event) {
        this.clickedIconValue = event.target.value;
    }
}

works differently in two different orgs, what is the difference?

Both orgs are on the same Salesforce release.

In org A, when user clicks on a button, the button number is displayed below.

In org B, when user clicks on a button, nothing happens.

The difference is in the Web Security settings.

In org A, Lightning Web Security is turned on and custom undefined attributes are set and passed correctly in DOM.

In org B, Lightning Web Security is turned off and any custom undefined attributes are ignored and removed from DOM.

Opening a SF Support Case on this topic.

Answer from SF Support.

Kind;y be informed that ‘event.target.value’ behaves differently based on how each security framework handles the DOM at an architectural level.

Lightning Locker: — — — — — — — — — -

Lightning Locker secures the DOM by wrapping elements in secure proxy objects such as SecureElement, SecureTemplate, and SecureWindow. When your click handler is called, event.target is one of these proxy objects, and not the real DOM element. The proxy only exposes properties that are part of the component’s officially published API. The published properties of lightning-icon are:

alternative-text icon-name size src variant

Since ‘value’ is not a published property, the SecureElement proxy does not expose it, and event.target.value returns undefined. No error is thrown, which can make this behavior difficult to detect during testing.

Lightning Web Security (LWS): — — — — — — — — — — — — — — — — -

Lightning Web Security (LWS) takes a fundamentally different approach. Instead of wrapping DOM elements in proxy objects, it uses native browser-level JavaScript isolation. Because the code interacts more directly with the actual DOM element rather than a proxy wrapper, non-published attributes defined in markup may appear accessible as standard DOM properties. This is why event.target.value would work under LWS -> not because value is a supported or an officially exposed property, but because LWS does not filter out such properties in the same way Locker does.

Kind Note: Even though event.target.value may work under LWS, this is not a supported or guaranteed behavior in either framework. Since value is not a published property of lightning-icon, relying on it is considered undefined behavior, regardless of whether Lightning Locker or LWS is enabled.