diff --git a/src/wp-includes/customize/class-wp-customize-nav-menu-item-setting.php b/src/wp-includes/customize/class-wp-customize-nav-menu-item-setting.php
index b5ce2e3cf4..df5050d195 100644
--- a/src/wp-includes/customize/class-wp-customize-nav-menu-item-setting.php
+++ b/src/wp-includes/customize/class-wp-customize-nav-menu-item-setting.php
@@ -711,10 +711,13 @@ public function sanitize( $menu_item_value ) {
 		$menu_item_value['description'] = wp_unslash( apply_filters( 'content_save_pre', wp_slash( $menu_item_value['description'] ) ) );
 
 		if ( '' !== $menu_item_value['url'] ) {
-			$menu_item_value['url'] = esc_url_raw( $menu_item_value['url'] );
-			if ( '' === $menu_item_value['url'] ) {
+			// Validate URL with the same regex as on the frontend
+			if ( ! preg_match( '/^((\w+:)?\/\/\w.*|\w+:(?!\/\/$)|\/|\?|#)/', $menu_item_value['url'] ) ) {
 				return new WP_Error( 'invalid_url', __( 'Invalid URL.' ) ); // Fail sanitization if URL is invalid.
 			}
+			$menu_item_value['url'] = esc_url_raw( $menu_item_value['url'] );
+		} else {
+			return new WP_Error( 'invalid_url', __( 'Invalid URL.' ) ); // Fail sanitization if URL is empty.
 		}
 		if ( 'publish' !== $menu_item_value['status'] ) {
 			$menu_item_value['status'] = 'draft';