Goodbye innerHTML, hello setHTML:
document.body.setHTML(`<h1>Hello my name is <img src="x" onclick="alert('XSS')">`);
translates to ->
<h1>Hello my name is</h1>
@webdevs.firefox.comThe Sanitizer API landed in Firefox 148, along with element.setHTML().
This lets you fully configure how HTML strings are cleaned as they're parsed.
hacks.mozilla.org/2026/02/good...
hacks.mozilla.org
Goodbye innerHTML, Hello setHTML: Stronger XSS Protection in Firefox 148 – Mozilla Hacks - the Web developer blog
Cross-site scripting (XSS) remains one of the most prevalent vulnerabilities on the web. The new standardized Sanitizer API provides a straightforward way for web developers to sanitize untrusted…
