v148 · HTML · JavaScript

Insertion Method Compare

Chrome 148 adds setHTML(), appendHTML(), and streamHTMLUnsafe() as modern alternatives to innerHTML. Try each method live and see how they differ in sanitization, streaming capability, and DOM semantics. A feature matrix summarises what each method can and cannot do.

HTML insertion method explorer
innerHTML — legacy (XSS risk)

Directly sets parsed HTML. No sanitization. Parses synchronously — no streaming possible.

Output appears here
XSS risk: event handler survived
setHTML — Chrome 148 (sanitized)

Replaces content with sanitized HTML. Strips scripts and dangerous attributes. Uses the HTML Sanitizer API internally.

Output appears here
—
appendHTML — Chrome 148 (sanitized)

Appends sanitized HTML to existing content. Multiple calls accumulate without clearing.

    —
    streamHTMLUnsafe — Chrome 148 (streaming)

    Pipes a ReadableStream of HTML chunks into the element. Content appears progressively as chunks arrive. Unsanitized — use with trusted sources only.

    Click Stream to start…
    —
    FeatureinnerHTMLsetHTMLappendHTMLstreamHTMLUnsafe
    Available pre-148✓✗✗✗
    Sanitizes HTML✗ no✓ yes✓ yes✗ unsafe
    Streaming support✗✗✗✓ ReadableStream
    Replaces content✓✓✗ (appends)✓
    Appends to contentmanual✗✓✗
    Strips <script>✗✓✓✗
    Strips event attrs✗✓✓✗
    Progressive render✗✗per-call✓ true streaming
    Sanitizer confign/a✓ optional✓ optionaln/a
    Try each insertion method. setHTML/appendHTML are sanitized replacements for innerHTML — safe for user-provided HTML. streamHTMLUnsafe is for trusted streams (SSR responses, LLM output) where you control the source.
    // Chrome 148: new HTML insertion methods // setHTML — sanitized replace (Sanitizer API built in) el.setHTML('<p><strong>Safe</strong></p><script>evil()</script>'); // script is stripped; safe HTML is applied // appendHTML — sanitized append el.appendHTML('<li>New item</li>'); // streamHTMLUnsafe — streaming (use only with trusted sources) const stream = response.body .pipeThrough(new TextDecoderStream()); await el.streamHTMLUnsafe(stream);

    see also

    implementation reference

    Need the exact API surface, compatibility boundaries, errors, lifecycle, and source links? Read the matching gendn reference ↗