---
title: "Goodbye innerHTML, Hello setHTML: Stronger XSS Protection in Firefox 148"
url: https://daily.dev/posts/goodbye-innerhtml-hello-sethtml-stronger-xss-protection-in-firefox-148-kqwqtubfz
source_url: https://hacks.mozilla.org/2026/02/goodbye-innerhtml-hello-sethtml-stronger-xss-protection-in-firefox-148/
type: article
source: "Mozilla Hacks"
published: 2026-02-24T13:01:06.023Z
updated: 2026-02-24T13:01:33.106Z
tags: ["security", "firefox", "web-security"]
reading_time: 3
upvotes: 61
comments: 4
language: en
---

> ## Documentation Index
> Fetch the complete documentation index at: https://daily.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Goodbye innerHTML, Hello setHTML: Stronger XSS Protection in Firefox 148

**[Mozilla Hacks](https://daily.dev/sources/hacks)** · 3 min read · 61 upvotes · 4 comments

## Summary

Firefox 148 is the first browser to ship the standardized Sanitizer API, which provides built-in XSS protection by sanitizing untrusted HTML before DOM insertion. The new `setHTML()` method replaces the error-prone `innerHTML` assignment, stripping dangerous elements and attributes by default. Developers can customize the sanitization configuration for stricter or more permissive rules, and can combine `setHTML()` with Trusted Types for centralized control over HTML injection. This approach requires minimal code changes and no dedicated security team, making XSS prevention accessible to a broader range of developers.

## Full article

daily.dev links to this article rather than hosting it. Read it at the original source: <https://hacks.mozilla.org/2026/02/goodbye-innerhtml-hello-sethtml-stronger-xss-protection-in-firefox-148/>

## Community discussion

Top comments from developers on daily.dev.

**@fabianletsch** · 3 upvotes

> Making the browser handle sanitization instead of having libraries for that is a great idea!

**@h2onock** · 1 upvotes

> A great step forwards. Kind of wild that it’s taken this long when you think about it 😬

**@dhruvil0204** · 0 upvotes

> Great thing.

**@lukyan** · 0 upvotes

> web still getting awesome features regularly

## Similar posts on daily.dev

- [Goodbye innerHTML, Hello setHTML – Frontend Masters Blog](https://daily.dev/posts/goodbye-innerhtml-hello-sethtml-frontend-masters-blog-lkqhz1opg) · Frontend Masters · 2 upvotes · 0 comments
- [Element: setHTML\(\) method - Web APIs](https://daily.dev/posts/element-sethtml-method---web-apis-alvm8fbaf) · Lobsters · 47 upvotes · 3 comments
- [Frederik Braun: Why the Sanitizer API is just <code>setHTML\(\)<](https://daily.dev/posts/frederik-braun-why-the-sanitizer-api-is-just-code-sethtml--rssbhonwv) · Lobsters · 0 upvotes · 0 comments

---

Tags: [#security](https://daily.dev/tags/security), [#firefox](https://daily.dev/tags/firefox), [#web-security](https://daily.dev/tags/web-security)

[View this post on daily.dev](https://daily.dev/posts/goodbye-innerhtml-hello-sethtml-stronger-xss-protection-in-firefox-148-kqwqtubfz)