# Firefox Releases

Published articles for Firefox Releases.

This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles.

## Goodbye innerHTML, Hello setHTML: Stronger XSS Protection in Firefox 148

DevFeed: [Goodbye innerHTML, Hello setHTML: Stronger XSS Protection in Firefox 148](<https://devfeed.tech/articles/goodbye-innerhtml-hello-sethtml-stronger-xss-protection-in-firefox-148-4146.md>)

Original publisher: [Read original article](<https://hacks.mozilla.org/2026/02/goodbye-innerhtml-hello-sethtml-stronger-xss-protection-in-firefox-148/>)

Author: Tom Schuster

Published: 2026-02-24T13:00:02Z

Content type: tutorial

Language: en

Sources: [Mozilla Hacks - the Web developer blog](<https://devfeed.tech/sources/mozilla-hacks-the-web-developer-blog.md>)

Topics: [Vulnerabilities](<https://devfeed.tech/topics/vulnerabilities.md>), [Web platform](<https://devfeed.tech/topics/web-platform.md>), [Web Development](<https://devfeed.tech/topics/web-development.md>)

Tags: [api](<https://devfeed.tech/tags/api.md>), [browser](<https://devfeed.tech/tags/browser.md>), [featured-article](<https://devfeed.tech/tags/featured-article.md>), [firefox](<https://devfeed.tech/tags/firefox.md>), [firefox-releases](<https://devfeed.tech/tags/firefox-releases.md>), [html](<https://devfeed.tech/tags/html.md>), [javascript](<https://devfeed.tech/tags/javascript.md>), [security](<https://devfeed.tech/tags/security.md>), [vulnerabilities](<https://devfeed.tech/tags/vulnerabilities.md>), [web-developers](<https://devfeed.tech/tags/web-developers.md>)

### AI overview

Firefox 148 ships the standardized Sanitizer API, including setHTML(), to sanitize untrusted HTML and reduce XSS risk. The article explains replacing innerHTML assignments, configuring allowed elements and attributes, and combining the API with Trusted Types for stronger protection.

### Source excerpt

Cross-site scripting (XSS) remains one of the most prevalent vulnerabilities on the web. The new standardized Sanitizer API provides a straightforward way for web developers to sanitize untrusted HTML before inserting it into the DOM. Firefox 148 is the first browser to ship this standardized security enhancing API, advancing a safer web for everyone. We [...] The post Goodbye innerHTML, Hello setHTML: Stronger XSS Protection in Firefox 148 appeared first on Mozilla Hacks - the Web developer blog.