Created attachment 467474 [details]
HTML page with dialog and relevant inputs for testing

When a dialog element is opened in Safari, input type="range" and input type="number" elements outside of the dialog that are marked `inert` when the dialog is opened are reachable via the arrow keys when navigating with VoiceOver.  See attached video example or follow steps below.

Steps to reproduce:
1. Open attached html example in Safari
2. Turn VoiceOver on
3. Using VoiceOver, open the dialog via the "Open Dialog" button
4. Use the arrow keys to navigate through the dialog elements
5. Observe that VoiceOver navigates past the boundary of the dialog and focuses the thumb of the range input and reads "value indicator", and focuses the spin buttons of the number input and reads "0, stepper"

Expected result: VoiceOver should not access any inert web content behind an open dialog
Actual result: VoiceOver reads certain inert input elements when navigating content in a dialog

I tested this with a variety of other input types and did not encounter the same issue, only with range and number.  It also appears to be limited to Safari; I was unable to reproduce the issue in Chrome or Firefox.

Tested on Safari 16.6, macOS Big Sur 11.7.9.  Unable to confirm whether this is reproducible on other macOS versions.