diff --git a/Tests/LibWeb/Text/expected/XHR/XMLHttpRequest-forbidden-method.txt b/Tests/LibWeb/Text/expected/XHR/XMLHttpRequest-forbidden-method.txt
new file mode 100644
index 00000000000..7ef22e9a431
--- /dev/null
+++ b/Tests/LibWeb/Text/expected/XHR/XMLHttpRequest-forbidden-method.txt
@@ -0,0 +1 @@
+PASS
diff --git a/Tests/LibWeb/Text/input/XHR/XMLHttpRequest-forbidden-method.html b/Tests/LibWeb/Text/input/XHR/XMLHttpRequest-forbidden-method.html
new file mode 100644
index 00000000000..3c2c0e93478
--- /dev/null
+++ b/Tests/LibWeb/Text/input/XHR/XMLHttpRequest-forbidden-method.html
@@ -0,0 +1,20 @@
+<script src="../include.js"></script>
+<script>
+    test(() => {
+        const forbiddenMethods = ["CONNECT", "TRACE", "TRACK"];
+        const SECURITY_ERR = 18;
+        let i = 0;
+        for (const method of forbiddenMethods) {
+            const xhr = new XMLHttpRequest();
+            try {
+                xhr.open(method, "data:text/plain,", true);
+            }
+            catch (e) {
+                if (e.code === SECURITY_ERR)
+                    i += 1;
+            }
+        }
+        if (i === forbiddenMethods.length)
+            println("PASS");
+    });
+</script>