Limited Availability

Sanitizer API

The Sanitizer API customizes the sanitization of HTML parsed and inserted into the DOM in a way that can prevent cross-site scripting attacks. You can use it with DOM APIs that accept a sanitizer option, such as parseHTML() or setHTML().

Baseline Status: This feature is currently Limited (not yet Baseline). Latest engine implementation shipped on Mar 13, 2026.

Desktop Browser Engine Support

Google Chrome

146

Supported

Mozilla Firefox

148

Supported

Apple Safari

—

Unsupported

Microsoft Edge

146

Supported

Mobile Browser Engine Support

Chrome Android

146

Firefox Android

148

Safari iOS

—

Specifications and References

Specification ↗ Feature XML ↗

MDN Browser Compat Data Keys:

api.Document.parseHTML_static ↗ api.Element.setHTML ↗ api.Sanitizer ↗ api.Sanitizer.Sanitizer ↗ api.Sanitizer.allowAttribute ↗ api.Sanitizer.allowElement ↗ api.Sanitizer.get ↗ api.Sanitizer.removeAttribute ↗ api.Sanitizer.removeElement ↗ api.Sanitizer.removeUnsafe ↗ api.Sanitizer.replaceElementWithChildren ↗ api.Sanitizer.setComments ↗ api.Sanitizer.setDataAttributes ↗ api.ShadowRoot.setHTML ↗