DOM sanitization is the process of cleaning HTML before it is inserted into a web page’s Document Object Model (DOM). Its goal is to remove dangerous tags, event handlers, scriptable attributes, and malformed markup that could change page behavior. In practice, sanitization helps convert untrusted input into safe text or safe HTML.
This matters because many attacks, especially cross-site scripting (XSS), rely on getting malicious markup into a browser context. If a sanitizer misses an attribute, allows an unsafe tag, or is applied after the content has already reached a DOM sink, attacker-controlled code may execute in the victim’s session. Defenders use DOM sanitization in comment systems, rich text editors, map credits, chat apps, and other interfaces that display user-generated content. Good defense also includes safe DOM APIs, tight allowlists, Content Security Policy, and Trusted Types, because sanitization is only one layer of protection.