diff --git a/Tests/InputFilterTest.php b/Tests/InputFilterTest.php
index cda40c01..8ef54952 100644
--- a/Tests/InputFilterTest.php
+++ b/Tests/InputFilterTest.php
@@ -2048,4 +2048,17 @@ public function testCleanObject()
 
         $this->assertEquals($expected, $filter->clean($object));
     }
+
+    /**
+     * A tab inside the scheme must not slip a data:text/html URI past the attribute filter,
+     * as browsers strip tab/newline characters when parsing a URL.
+     */
+    public function testCleanStripsTabbedHtmlDataUri()
+    {
+        $filter = new InputFilter(['a'], ['href']);
+
+        $input = "<a href=\"data:text/\thtml;base64,PHNjcmlwdD5hbGVydCgxKTwvc2NyaXB0Pg==\">Data link</a>";
+
+        $this->assertSame('<a>Data link</a>', $filter->clean($input, 'html'));
+    }
 }
diff --git a/src/InputFilter.php b/src/InputFilter.php
index ed60b0cc..d2bd33df 100644
--- a/src/InputFilter.php
+++ b/src/InputFilter.php
@@ -586,8 +586,8 @@ protected function cleanAttributes(array $attrSet)
             // Strips unicode, hex, etc
             $attrSubSet[1] = str_replace('&#', '', $attrSubSet[1]);
 
-            // Strip normal newline within attr value
-            $attrSubSet[1] = preg_replace('/[\n\r]/', '', $attrSubSet[1]);
+            // Strip tab and newline within attr value (browsers drop these when parsing a URL)
+            $attrSubSet[1] = preg_replace('/[\t\n\r]/', '', $attrSubSet[1]);
 
             // Strip double quotes
             $attrSubSet[1] = str_replace('"', '', $attrSubSet[1]);