Browser security
Compatibility & evidence
Content execution

Trusted Types enforcement

Restricts selected DOM injection sinks to values created through approved policies.

Support in current browsers

Checked against the current browser versions recorded in MDN browser data 8.1.5.

BrowserMinimumOutcomeReason
Chrome155WorksEvery required mapped BCD feature is available without a recorded qualification.
Edge154WorksEvery required mapped BCD feature is available without a recorded qualification.
Firefox157WorksEvery required mapped BCD feature is available without a recorded qualification.
Safari27WorksEvery required mapped BCD feature is available without a recorded qualification.
Chrome for Android155WorksEvery required mapped BCD feature is available without a recorded qualification.
Firefox for Android157WorksEvery required mapped BCD feature is available without a recorded qualification.
Safari on iOS27WorksEvery required mapped BCD feature is available without a recorded qualification.
Android WebView155WorksEvery required mapped BCD feature is available without a recorded qualification.
Samsung Internet30.0WorksEvery required mapped BCD feature is available without a recorded qualification.
The release trace

How support changed

Each segment groups recorded releases with the same result. Gaps between recorded versions are not filled in. This is support at each release, rather than the planner’s check of every release above a minimum.

Chrome

api.trustedTypes
  1. 1 – 8181 recorded releases
    Not supported
  2. 83 – 15573 recorded releases
    Works
http.headers.Content-Security-Policy.require-trusted-types-for
  1. 1 – 8181 recorded releases
    Not supported
  2. 83 – 15573 recorded releases
    Works

Edge

api.trustedTypes
  1. 12 – 8110 recorded releases
    Not supported
  2. 83 – 15472 recorded releases
    Works
http.headers.Content-Security-Policy.require-trusted-types-for
  1. 12 – 8110 recorded releases
    Not supported
  2. 83 – 15472 recorded releases
    Works

Firefox

api.trustedTypes
  1. 1 – 147150 recorded releases
    Not supported
  2. 148 – 15710 recorded releases
    Works
http.headers.Content-Security-Policy.require-trusted-types-for
  1. 1 – 147150 recorded releases
    Not supported
  2. 148 – 15710 recorded releases
    Works

Safari

api.trustedTypes
  1. 1 – 18.653 recorded releases
    Not supported
  2. 26 – 278 recorded releases
    Works
http.headers.Content-Security-Policy.require-trusted-types-for
  1. 1 – 18.653 recorded releases
    Not supported
  2. 26 – 278 recorded releases
    Works

Chrome for Android

api.trustedTypes
  1. 18 – 8158 recorded releases
    Not supported
  2. 83 – 15573 recorded releases
    Works
http.headers.Content-Security-Policy.require-trusted-types-for
  1. 18 – 8158 recorded releases
    Not supported
  2. 83 – 15573 recorded releases
    Works

Firefox for Android

api.trustedTypes
  1. 4 – 147131 recorded releases
    Not supported
  2. 148 – 15710 recorded releases
    Works
http.headers.Content-Security-Policy.require-trusted-types-for
  1. 4 – 147131 recorded releases
    Not supported
  2. 148 – 15710 recorded releases
    Works

Safari on iOS

api.trustedTypes
  1. 1 – 18.650 recorded releases
    Not supported
  2. 26 – 278 recorded releases
    Works
http.headers.Content-Security-Policy.require-trusted-types-for
  1. 1 – 18.650 recorded releases
    Not supported
  2. 26 – 278 recorded releases
    Works

Android WebView

api.trustedTypes
  1. 1 – 8153 recorded releases
    Not supported
  2. 83 – 15573 recorded releases
    Works
http.headers.Content-Security-Policy.require-trusted-types-for
  1. 1 – 8153 recorded releases
    Not supported
  2. 83 – 15573 recorded releases
    Works

Samsung Internet

api.trustedTypes
  1. 1.0 – 12.129 recorded releases
    Not supported
  2. 13.0 – 30.023 recorded releases
    Works
http.headers.Content-Security-Policy.require-trusted-types-for
  1. 1.0 – 12.129 recorded releases
    Not supported
  2. 13.0 – 30.023 recorded releases
    Works

BCD 8.1.5 · catalogue 2.3.0. Source corrections can change this trace without a new browser release.

What this feature can and cannot do

Helps protect against

  • DOM cross-site scripting
  • Unsafe DOM sink use

Does not guarantee

  • All injection sinks
  • Unsafe policy implementations
  • Server-side cross-site scripting

What you need before using it

  • Trusted Types policy design
  • CSP enforcement directive
  • Sink migration

Fallback to keep in place

Continue sink review, output encoding, and nonce- or hash-based CSP deployment.