Firefox 148 introduces the standardized Sanitizer API, marking the first browser implementation of this security enhancement designed to combat XSS vulnerabilities. The new setHTML() method replaces error-prone innerHTML assignments with built-in sanitization, providing safety by default when inserting untrusted HTML into the DOM.

Cross-site scripting has consistently ranked among the top three web vulnerabilities for nearly a decade, allowing attackers to inject malicious HTML or JavaScript through user-generated content. While Content-Security-Policy offered strong protection, its adoption remained limited due to architectural complexity. The Sanitizer API fills this gap by providing a standardized approach to convert malicious HTML into harmless content.

Developers can easily upgrade their code by replacing innerHTML with setHTML(), with options to customize sanitization rules for specific use cases. The API integrates seamlessly with Trusted Types, enabling centralized control over HTML parsing and injection. This combination allows sites to enforce stricter security policies without complex custom implementations. Firefox's implementation advances a safer web for everyone, with other browsers expected to follow soon.