Unsanitized HTML parsing methods

The Document.parseHTMLUnsafe() static method parses HTML into a DOM tree, while the setHTMLUnsafe() method of Element and ShadowRoot parses and inserts HTML into an existing tree. No sanitization applies to these methods, so never call them with user-provided HTML strings.

Baseline Status: Achieved Newly Available on Sep 15, 2025 across core engines.

Desktop Browser Engine Support

Google Chrome

124

Supported

Mozilla Firefox

128

Supported

Apple Safari

26

Supported

Microsoft Edge

124

Supported

Mobile Browser Engine Support

Chrome Android

124

Firefox Android

128

Safari iOS

26

Specifications and References

Specification ↗ Feature XML ↗

MDN Browser Compat Data Keys:

api.Document.parseHTMLUnsafe_static ↗ api.Element.setHTMLUnsafe ↗ api.ShadowRoot.setHTMLUnsafe ↗