This could be caused by someone passing some JS value that isn't a DOM Node to the jQuery constructor and then using event propagation, e.g.

var x =  Math.random();
var y = new Vue();
$( x ).trigger( 'click' );
$( y ).trigger( 'focus' );

Or where the value is a DOM Node reference obtained from a different security context that you can pass around but not inspect, e.g. something from an iframe.

Do the URLs have something in common? E.g. edit page, article views, a special page, etc.

Ignore my last comment I was reading the graph wrong. There is more than 1 IP address with this error.

I'm starting to suspect CentralAuth and the login/signup workflow as the module ext.centralauth.centralautologin appears consistently in all the file_urls and would explain why we can't easily replicate the error.

Could somebody who knows the extension check that code?

Update: I think it's possible module may be present for all anons - that may be a red herring - but if so that will tell us this problem only impacts anonymous users.

In T264245#6637786, @Jdlrobson wrote:

I'm starting to suspect CentralAuth and the login/signup workflow as the module ext.centralauth.centralautologin appears consistently in all the file_urls and would explain why we can't easily replicate the error.
[…]
Update: I think it's possible module may be present for all anons - that may be a red herring - but if so that will tell us this problem only impacts anonymous users.

That's right. This module is loaded unconditionally on all logged-out page loads.

At this point I'm still not able to work out where this task originates. My guess is that there's something running Wikipedia in an iframe.
I think if https://gerrit.wikimedia.org/r/c/mediawiki/extensions/WikimediaEvents/+/634295 doesn't shed any more light, it probably makes sense to consider this as spam and manually drop any error with the message "Error: Permission denied to access property".

Change 659492 had a related patch set uploaded (by Jdlrobson; owner: Jdlrobson):
[mediawiki/extensions/WikimediaEvents@master] Do not log client errors when in iframe

https://gerrit.wikimedia.org/r/659492

In T264245#6741298, @Jdlrobson wrote:

At this point I'm still not able to work out where this task originates. My guess is that there's something running Wikipedia in an iframe.
I think if https://gerrit.wikimedia.org/r/c/mediawiki/extensions/WikimediaEvents/+/634295 doesn't shed any more light, it probably makes sense to consider this as spam and manually drop any error with the message "Error: Permission denied to access property".

I think you're right. However, I don't think cases where Wikipedia itself is iframed would lead to use receiving permission errors with things that we do inside of that iframe. Rather, a permission error would be seen by the outer context trying to access us, which we wouldn't notice or receive.

Conversely, relevant to us, these kinds errors could happen when JavaScript that runs on our site is in the one creating an iframe (e.g. a gadget using an iframe to show a map or something), and then attempting to access stuff inside of it, which is naturally not allowed and so the code on "our" side is receiving that error.

E.g. when running something like the following from wikipedia.org:

i = document.createElement('iframe')
i.href = 'https://example.org/';
document.body.append(i);
// …
i.contentWindow.document.body.outerHTML

Surprisingly, this actually does not lead to an error in Firefox. Which browser are we seeing this permission error from?

Anyway, I've landed the commit since it seems good practice to also ignore any rare issues that might arise when Wikipedia page views are embedded in an iframe elsewhere on the web.

Change 659492 merged by jenkins-bot:
[mediawiki/extensions/WikimediaEvents@master] Do not log client errors when inside an iframe

https://gerrit.wikimedia.org/r/659492

Change 664643 had a related patch set uploaded (by Jdlrobson; owner: Jdlrobson):
[mediawiki/extensions/WikimediaEvents@master] Ignore permission denied errors in error tracking

https://gerrit.wikimedia.org/r/664643

Anyway, I've landed the commit since it seems good practice to also ignore any rare issues that might arise when Wikipedia page views are embedded in an iframe elsewhere on the web.

Yup this fix had no impact on the number of errors we are seeing here. So as suggested let's ignore any permission denied errors in our logging.

Change 664643 merged by jenkins-bot:
[mediawiki/extensions/WikimediaEvents@master] clientError: Ignore permission denied errors in error tracking

https://gerrit.wikimedia.org/r/664643