Trusted typesBaseline · Newly available

Trusted types allow you to lock down insecure parts of the DOM API and prevent client-side cross-site scripting (XSS) attacks.

Works in the latest version of every major browser, but older devices may not support it yet. Baseline since Feb 24, 2026.

How to use ↓Compare browsers

Browser support

DesktopChrome

1–81Not supported

83+Supportedsince May 19, 2020

Current: 155

Edge

12–81Not supported

83+Supportedsince May 21, 2020

Current: 154

Firefox

1–147Not supported

148+Supportedsince Feb 24, 2026

Current: 157

Safari

1–18.6Not supported

26+Supportedsince Sep 15, 2025

Current: 27

MobileChrome Android

18–81Not supported

83+Supportedsince May 19, 2020

Current: 155

Firefox Android

4–147Not supported

148+Supportedsince Feb 24, 2026

Current: 157

Safari iOS

1–18.6Not supported

26+Supportedsince Sep 15, 2025

Current: 27

How to use

Every current browser supports this, but it only became Baseline on Feb 24, 2026. Use it as a progressive enhancement, or keep a fallback if you support older devices.

Example

Full syntax and examples are on MDN: TrustedHTML.

Feature detection

JS · check before using

if ("trustedTypes" in globalThis) {
  // trustedTypes is available
} else {
  // load a polyfill or use a fallback
}

Documentation (MDN)

Specification

w3c.github.io/trusted-types/dist/spec ↗

Usage share

caniuse.com/trusted-types ↗

Sub-features

Support for each part of the feature (35). The overall table above shows when the whole feature works.

Sub-feature	Chrome	Edge	Firefox	Safari	Chrome Android	Firefox Android	Safari iOS
Element.innerHTML.enforces_trusted_types	83	83	148	26	83	148	26
HTMLScriptElement.innerText.enforces_trusted_types	83	83	148	26	83	148	26
HTMLScriptElement.src.enforces_trusted_types	83	83	148	26	83	148	26
HTMLScriptElement.text.enforces_trusted_types	83	83	148	26	83	148	26
HTMLScriptElement.textContent.enforces_trusted_types	83	83	148	26	83	148	26
ShadowRoot.innerHTML.enforces_trusted_types	83	83	148	26	83	148	26
TrustedHTML	83	83	148	26	83	148	26
TrustedHTML.toJSON	90	90	148	26	90	148	26
TrustedHTML.toString	83	83	148	26	83	148	26
TrustedScript	83	83	148	26	83	148	26
TrustedScript.toJSON	90	90	148	26	90	148	26
TrustedScript.toString	83	83	148	26	83	148	26
TrustedScriptURL	83	83	148	26	83	148	26
TrustedScriptURL.toJSON	90	90	148	26	90	148	26
TrustedScriptURL.toString	83	83	148	26	83	148	26
TrustedTypePolicy	83	83	148	26	83	148	26
TrustedTypePolicy.createHTML	83	83	148	26	83	148	26
TrustedTypePolicy.createScript	83	83	148	26	83	148	26
TrustedTypePolicy.createScriptURL	83	83	148	26	83	148	26
TrustedTypePolicy.name	83	83	148	26	83	148	26

Show 15 more

Sub-feature	Chrome	Edge	Firefox	Safari	Chrome Android	Firefox Android	Safari iOS
TrustedTypePolicyFactory	83	83	148	26	83	148	26
TrustedTypePolicyFactory.createPolicy	83	83	148	26	83	148	26
TrustedTypePolicyFactory.defaultPolicy	83	83	148	26	83	148	26
TrustedTypePolicyFactory.emptyHTML	83	83	148	26	83	148	26
TrustedTypePolicyFactory.emptyScript	83	83	148	26	83	148	26
TrustedTypePolicyFactory.getAttributeType	83	83	148	26	83	148	26
TrustedTypePolicyFactory.getPropertyType	83	83	148	26	83	148	26
TrustedTypePolicyFactory.isHTML	83	83	148	26	83	148	26
TrustedTypePolicyFactory.isScript	83	83	148	26	83	148	26
TrustedTypePolicyFactory.isScriptURL	83	83	148	26	83	148	26
setInterval.code_param_enforces_trusted_types	83	83	148	26	83	148	26
setTimeout.code_param_enforces_trusted_types	83	83	148	26	83	148	26
trustedTypes	83	83	148	26	83	148	26
http.headers.Content-Security-Policy.require-trusted-types-for	83	83	148	26	83	148	26
http.headers.Content-Security-Policy.trusted-types	83	83	148	26	83	148	26