ControlCurrentbrowser security planning
Content execution

Trusted Types enforcement

Restricts selected DOM injection sinks to values created through approved policies.

Support in current browsers

Checked against the current browser versions recorded in MDN browser data 8.0.7.

BrowserMinimumOutcomeReason
Chrome150WorksEvery required mapped BCD feature is available without a recorded qualification.
Edge150WorksEvery required mapped BCD feature is available without a recorded qualification.
Firefox152WorksEvery required mapped BCD feature is available without a recorded qualification.
Safari26.5WorksEvery required mapped BCD feature is available without a recorded qualification.
Chrome for Android150WorksEvery required mapped BCD feature is available without a recorded qualification.
Firefox for Android152WorksEvery required mapped BCD feature is available without a recorded qualification.
Safari on iOS26.5WorksEvery required mapped BCD feature is available without a recorded qualification.
Android WebView150WorksEvery required mapped BCD feature is available without a recorded qualification.
Samsung Internet29.0WorksEvery required mapped BCD feature is available without a recorded qualification.

What this feature can and cannot do

Helps protect against

  • DOM cross-site scripting
  • Unsafe DOM sink use

Does not guarantee

  • All injection sinks
  • Unsafe policy implementations
  • Server-side cross-site scripting

What you need before using it

  • Trusted Types policy design
  • CSP enforcement directive
  • Sink migration

Fallback to keep in place

Continue sink review, output encoding, and nonce- or hash-based CSP deployment.