https://hacks.mozilla.org/2026/02/goodbye-innerhtml-hello-sethtml-stronger-xss-protection-in-firefox-148/ [mdn-logo-m] Mozilla Hacks [ ] Hacks on YouTube @mozhacks on Twitter Hacks RSS Feed Download Firefox Goodbye innerHTML, Hello setHTML: Stronger XSS Protection in Firefox 148 [f9a1c47e] By Tom Schuster, Frederik Braun, Christoph Kerschbaumer Posted on February 24, 2026 in Featured Article, Firefox, Firefox Releases, and Web Developers Cross-site scripting (XSS) remains one of the most prevalent vulnerabilities on the web. The new standardized Sanitizer API provides a straightforward way for web developers to sanitize untrusted HTML before inserting it into the DOM. Firefox 148 is the first browser to ship this standardized security enhancing API, advancing a safer web for everyone. We expect other browsers to follow soon. An XSS vulnerability arises when a website inadvertently lets attackers inject arbitrary HTML or JavaScript through user-generated content. With this attack, an attacker could monitor and manipulate user interactions and continually steal user data for as long as the vulnerability remains exploitable. XSS has a long history of being notoriously difficult to prevent and has ranked among the top three web vulnerabilities (CWE-79) for nearly a decade. [sanitizer-diagram-optimized-2]Firefox has been deeply involved in solutions for XSS from the beginning, starting with spearheading the Content-Security-Policy (CSP) standard in 2009. CSP allows websites to restrict which resources (scripts, styles, images, etc.) the browser can load and execute, providing a strong line of defense against XSS. Despite a steady stream of improvements and ongoing maintenance, CSP did not gain sufficient adoption to protect the long tail of the web as it requires significant architectural changes for existing web sites and continuous review by security experts. The Sanitizer API is designed to help fill that gap by providing a standardized way to turn malicious HTML into harmless HTML -- in other words, to sanitize it. The setHTML( ) method integrates sanitization directly into HTML insertion, providing safety by default. Here is an example of sanitizing a simple unsafe HTML: document.body.setHTML(`

Hello my name is `); This sanitization will allow the HTML

element while removing the embedded element and its onclick attribute, thereby eliminating the XSS attack resulting in the following safe HTML:

Hello my name is

Developers can opt into stronger XSS protections with minimal code changes by replacing error-prone innerHTML assignments with setHTML() . If the default configuration of setHTML( ) is too strict (or not strict enough) for a given use case, developers can provide a custom configuration that defines which HTML elements and attributes should be kept or removed. To experiment with the Sanitizer API before introducing it on a web page, we recommend exploring the Sanitizer API playground. For even stronger protections, the Sanitizer API can be combined with Trusted Types, which centralize control over HTML parsing and injection. Once setHTML( ) is adopted, sites can enable Trusted Types enforcement more easily, often without requiring complex custom policies. A strict policy can allow setHTML( ) while blocking other unsafe HTML insertion methods, helping prevent future XSS regressions. The Sanitizer API enables an easy replacement of innerHTML assignments with setHTML( ) in existing code, introducing a new safer default to protect users from XSS attacks on the web. Firefox 148 supports the Sanitizer API as well as Trusted Types, which creates a safer web experience. Adopting these standards will allow all developers to prevent XSS without the need for a dedicated security team or significant implementation changes. --------------------------------------------------------------------- Image credits for the illustration above: Website, by Desi Ratna; Person, by Made by Made; Hacker by Andy Horvath. About Tom Schuster More articles by Tom Schuster... About Frederik Braun Frederik Braun builds security for the web and for Mozilla Firefox from Berlin. As a contributor to standards, Frederik is also improving the web platform by bringing security into the defaults with specifications like the Sanitizer API and Subresource Integrity. When not at work, Frederik likes reading a good novel or going on long bike treks across Europe. * https://frederikbraun.de More articles by Frederik Braun... About Christoph Kerschbaumer Christoph Kerschbaumer has over two decades of experience in software engineering and computer security. His expertise includes designing secure systems with fail-safe defaults, mitigating cross-site scripting vulnerabilities, preventing machine-in-the-middle attacks, and advancing security foundations for trustworthy AI systems. He currently leads the Firefox Security Engineering team at Mozilla. He earned his Ph.D. in Computer Science from the University of California, Irvine, where his research focused on information flow tracking techniques in web browsers. * https://christophkerschbaumer.com/ More articles by Christoph Kerschbaumer... Discover great resources for web development Sign up for the Mozilla Developer Newsletter: E-mail [ ] [ ] I'm okay with Mozilla handling my info as explained in this Privacy Policy. Sign up now Thanks! Please check your inbox to confirm your subscription. If you haven't previously confirmed a subscription to a Mozilla-related newsletter you may have to do so. Please check your inbox or your spam filter for an email from us. Except where otherwise noted, content on this site is licensed under the Creative Commons Attribution Share-Alike License v3.0 or any later version. the Mozilla dino logo