Index: wp-includes/theme.php
===================================================================
--- wp-includes/theme.php	(revision 51466)
+++ wp-includes/theme.php	(working copy)
@@ -3357,47 +3357,52 @@ function _wp_customize_include() {
 	);

 	$theme             = null;
 	$autosaved         = null;
 	$messenger_channel = null;

 	// Value false indicates UUID should be determined after_setup_theme
 	// to either re-use existing saved changeset or else generate a new UUID if none exists.
 	$changeset_uuid = false;

 	// Set initially fo false since defaults to true for back-compat;
 	// can be overridden via the customize_changeset_branching filter.
 	$branching = false;

 	if ( $is_customize_admin_page && isset( $input_vars['changeset_uuid'] ) ) {
-		$changeset_uuid = sanitize_key( $input_vars['changeset_uuid'] );
+		$changeset_uuid = $input_vars['changeset_uuid'];
 	} elseif ( ! empty( $input_vars['customize_changeset_uuid'] ) ) {
-		$changeset_uuid = sanitize_key( $input_vars['customize_changeset_uuid'] );
+		$changeset_uuid = $input_vars['customize_changeset_uuid'];
+	}
+
+	// Sanitize UUID
+	if ( $changeset_uuid && ! wp_is_uuid( $changeset_uuid ) ) {
+		$changeset_uuid = false;
 	}

 	// Note that theme will be sanitized via WP_Theme.
 	if ( $is_customize_admin_page && isset( $input_vars['theme'] ) ) {
 		$theme = $input_vars['theme'];
 	} elseif ( isset( $input_vars['customize_theme'] ) ) {
 		$theme = $input_vars['customize_theme'];
 	}

 	if ( ! empty( $input_vars['customize_autosaved'] ) ) {
 		$autosaved = true;
 	}

-	if ( isset( $input_vars['customize_messenger_channel'] ) ) {
+	if ( isset( $input_vars['customize_messenger_channel'] ) && is_string( $input_vars['customize_messenger_channel'] ) ) {
 		$messenger_channel = sanitize_key( $input_vars['customize_messenger_channel'] );
 	}

 	/*
 	 * Note that settings must be previewed even outside the customizer preview
 	 * and also in the customizer pane itself. This is to enable loading an existing
 	 * changeset into the customizer. Previewing the settings only has to be prevented
 	 * here in the case of a customize_save action because this will cause WP to think
 	 * there is nothing changed that needs to be saved.
 	 */
 	$is_customize_save_action = (
 		wp_doing_ajax()
 		&&
 		isset( $_REQUEST['action'] )
 		&&