Trusted Types is a browser security feature designed to stop unsafe data from being written into dangerous DOM sinks such as innerHTML, insertAdjacentHTML, and script-related APIs. Instead of letting application code pass raw strings, the browser can require special typed objects created by approved policies. This makes it much harder for attacker-controlled input to become executable markup or script through a missed validation step or sanitizer mistake.
It matters because many XSS bugs are not caused by obviously dangerous code, but by small trust-boundary failures where text is converted into HTML too early. In practice, defenders enable Trusted Types through Content Security Policy and pair it with safe DOM APIs and vetted sanitizers. If an application tries to inject a plain string into a protected sink, the browser blocks it and raises a clear signal during testing. That makes Trusted Types useful both as a preventive control and as a way to detect risky rendering paths before they become exploitable.