Trusted Types Reaches Full Browser Support, Turning DOM XSS Into a TypeError

·1 views

The Trusted Types API, a browser security feature that blocks dangerous DOM injection via raw strings, achieved Baseline status in February 2026 when Firefox 148 added support, completing coverage across all major browsers. Chrome and Edge had supported it since 2020, with Safari joining in version 26. The API works by enforcing that only values created through explicitly declared policies can be passed to risky sinks like innerHTML, outerHTML, and eval — raw strings now throw a TypeError. Developers can enable it via a Content-Security-Policy header, and are advised to start with report-only mode to identify violations before switching to full enforcement. Trusted Types does not sanitize content itself, but it narrows the entire DOM XSS attack surface to a small set of named policy functions that can be audited quickly.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

How a Single AI Agent Error Can Cascade Into a Fully Failed Run

When building LLM-based agents, a common assumption is that errors at each step are independent — but in practice, one mistake can corrupt every step that follows. Because agents continuously feed their own past outputs back as future inputs, a wrong fact or bad action entered into the transcript becomes a flawed foundation for all subsequent reasoning. This cascading failure mode differs from distributed system failures, which spread horizontally across many workers; agent cascades spread vertically through time within a single run. Three key propagation mechanisms include poisoned premises (wrong facts treated as established), error residue (failed attempts anchoring future reasoning), and committed actions (real-world changes that cannot be undone). The structural fix lies in identifying where in a trajectory context contamination can be intercepted or isolated before it compounds further.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

OpenAI Launches GPT-5.6-Cyber for Authorized Security Research via Daybreak Program

OpenAI has introduced GPT-5.6-Cyber, a specialized AI model built for professional cybersecurity tasks including vulnerability discovery, exploit validation, and security testing. The model is accessible through OpenAI's Daybreak Red tier, which is restricted to approved defenders and security researchers. GPT-5.6-Cyber achieved a 95% completion rate on OpenAI's internal Advanced Cybersecurity evaluation, far surpassing its predecessor GPT-5.5-Cyber at 57.3%. The model assisted researchers in identifying vulnerabilities in Chrome's V8 JavaScript engine, though benchmark results were mixed across other tests. OpenAI's Daybreak program maintains controlled access and human oversight to ensure the technology is used responsibly in defensive security environments.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Fitz LiveViews Tutorial: Handling Form Inputs and Live Data Without JavaScript

A new tutorial in the FitzLiveViews series explains how event handlers in Fitz LiveViews receive data through three mechanisms: click payloads, form submissions, and live input listeners. Each method populates a shared payload map that handlers read using standard key lookups, eliminating the need for manual DOM manipulation or fetch calls. The guide walks through building a live name list component supporting add, remove, and count operations using server-rendered and WebAssembly targets from a single codebase. Form fields use a data-flv-submit attribute to pass input values on submission, while real-time controls use input or change decorators to stream the current value into the same payload. This is the third installment in the series, building on earlier posts covering the framework's pitch and a basic counter.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Engineer Uses Systems Thinking to Make Sense of Personal Life Falling Apart

A software engineer reflects on how several key pillars of their personal life — relationships, career, home, and future plans — began to falter around the same time. Drawing on concepts from systems architecture, they compare the experience to cascading failures in software, where the loss of one component places greater stress on the rest. The author notes that human lives, like technical systems, accumulate dependencies over time without anyone consciously designing for resilience. When multiple supports weaken simultaneously, the ability to redistribute emotional and practical load becomes severely strained. The piece is a candid, introspective account of navigating simultaneous personal upheaval through the lens of an engineering mindset.

0 comments Read more at DEV Community