Trusted Types Checker
Summary: PortSwigger Research released a Burp Suite plugin called Trusted Types checker, version 1.0, last updated 08 January 2025, which checks for a number of misconfigurations of the Trusted Types browser functionality. Trusted Types restricts which content can be assigned to critical DOM APIs such as innerHTML or eval, requires developers to create policies via TrustedTypes.createPolicy(), and is enforced through CSP directives including require-trusted-types-for 'script' and trusted-types.
Why it matters: Trusted Types only reduces XSS risk when its policies and CSP directives are configured correctly, and this plugin exists specifically to find the misconfigurations that leave the protection inert.
Read the original at PortSwigger Research ↗
- Topics
- Vulnerabilities & Patching
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026