The Death of innerHTML: How Firefox 148’s setHTML() API Rewrites the Rules on Cross-Site Scripting Defense
Submitted by Anonymous (not verified) on Tue, 02/24/2026 - 16:13For more than two decades, web developers have relied on innerHTML to inject dynamic HTML content into web pages. It was simple, intuitive, and wildly dangerous. Now, with the release of Firefox 148, Mozilla has thrown its weight behind a new browser-native API called setHTML() that promises to eliminate one of the most persistent and damaging classes of web vulnerabilities: cross-site scripting, or XSS. The move marks a significant moment in browser security, one that arrives with broad cross-browser consensus and years of standards work behind it.