<?xml version="1.0" encoding="UTF-8"?>
<feature id="parse-html-unsafe"><name>Unsanitized HTML parsing methods</name><description>The Document.parseHTMLUnsafe() static method parses HTML into a DOM tree, while the setHTMLUnsafe() method of Element and ShadowRoot parses and inserts HTML into an existing tree. No sanitization applies to these methods, so never call them with user-provided HTML strings.</description><baseline><status>newly</status><low_date>2025-09-15</low_date></baseline><support><browser name="chrome" version="124" supported="true"></browser><browser name="firefox" version="128" supported="true"></browser><browser name="safari" version="26" supported="true"></browser><browser name="edge" version="124" supported="true"></browser><browser name="chrome_android" version="124" supported="true"></browser><browser name="firefox_android" version="128" supported="true"></browser><browser name="safari_ios" version="26" supported="true"></browser></support><specifications><spec>https://html.spec.whatwg.org/multipage/dynamic-markup-insertion.html#unsafe-html-parsing-methods</spec></specifications><caniuse></caniuse><mdn_url>https://developer.mozilla.org/docs/Web/API/Element/setHTMLUnsafe</mdn_url><compat_features><key>api.Document.parseHTMLUnsafe_static</key><key>api.Element.setHTMLUnsafe</key><key>api.ShadowRoot.setHTMLUnsafe</key></compat_features><canonical_url>https://nowyoucanuse.com/features--parse-html-unsafe.html</canonical_url></feature>