The HTML Sanitizer API sanitizes untrusted HTML before DOM insertion, removing XSS-dangerous content (scripts, event handlers) using the browser's own parser — eliminating parser-differential vulnerabilities that plague userland sanitizers.
The Trusted Types API prevents DOM-based XSS by enforcing that dangerous DOM sinks (innerHTML, eval(), document.write(), script.src, etc.) only accept typed objects instead of raw strings. When enforced via CSP, any attempt to pass a plain string to a dangerous sink throws a TypeError.