Trusted Types: DOM XSS Protection at Scale
Jen Ozmen, Youssef Attia
BSides NYC 2024 · Day 1 · Tech - Blue
This talk, presented by Jen Ozmen and Youssef Attia, Software Engineers at Google, introduces **Trusted Types**, an innovative browser feature designed to mitigate **DOM-based Cross-Site Scripting (XSS)** vulnerabilities at an unprecedented scale. The speakers, both working on Google's web security team, highlight the pervasive nature of XSS, citing Google's own vulnerability rewards program data where XSS consistently represents a significant portion of reported web bugs. Their work focuses on deploying web security mitigations across Google's vast ecosystem of web services, where the challenge lies in securing applications developed by hundreds of engineers.
AI review
A competent, well-structured walkthrough of Trusted Types from the team that actually shipped it at scale across 400+ Google products. The zero-DOM-XSS claim is the headline and it's earned, but the talk is fundamentally a deployment guide, not a research contribution — the mechanism itself is years old at this point.