This GitHub issue is for collecting web developer signals for Sanitizer API.

The Document.parseHTML() static method and the setHTML() method of Element and ShadowRoot objects parse and insert HTML into the DOM in a way that can prevent cross-site scripting attacks. The Sanitizer API can customize the sanitization process.

Browser support

• Chrome: not supported
• Chrome Android: not supported
• Edge: not supported
• Firefox 148 (Feb 24, 2026)
• Firefox for Android 148 (Feb 24, 2026)
• Safari: not supported
• Safari on iOS: not supported

Give us feedback

If you're pressed for time, but you want this feature to be available in all browsers, please give this issue a thumbs up 👍 reaction.

However, a much better guide for us is to know how you'd use this feature, and what you're having to do in the meantime. This helps us judge the priority versus other features.

Copy the template below in a comment, and add the details that matter to you.

## What I want to do with this feature

<!-- Add your specific use-cases, even if they seem obvious to you. -->

## What I'm having to do in the meantime

<!--
Are you having to use another feature instead, a polyfill, or is it blocking you completely?
Why are the alternatives worse than using this feature?
-->

All comments are expected to adhere to the Code of Conduct.

Learn more

You can learn more about this feature here:

• web features explorer
• webstatus.dev
• Specification