A trusted origin is the web boundary an app treats as its own. In browser security, an origin is the combination of scheme, host, and port; content from that origin may access same-origin data such as storage, cookies, and page state, and may be allowed to use app-integrated features.
This matters because origin trust is an access-control decision, not just a URL label. In hybrid apps and WebViews, if remote or attacker-controlled content is mistakenly loaded as a trusted origin, it can inherit privileges that were meant only for local app pages. Attackers look for path-routing mistakes, redirects, and internal proxy endpoints that let untrusted content cross that boundary. Defenders protect it by validating the full URL, isolating untrusted content, restricting navigation, and keeping sensitive pages on separate origins.