Trusted Types API
The Trusted Types API prevents DOM-based XSS by enforcing that dangerous DOM sinks (innerHTML, eval(), document.write(), script.src, etc.) only accept typed objects instead of raw strings. When enforced via CSP, any attempt to pass a plain string to a dangerous sink throws a TypeError.