Only when you control the value completely, or have already sanitized it, and you choose the matching security context. The bypassSecurityTrust methods tell Angular to stop sanitizing a value. If an attacker can influence that value, you have created an XSS hole yourself.
What the methods do
Angular treats all values as untrusted by default. When a value enters the DOM through a template binding or interpolation, Angular sanitizes and escapes it. Interpolated content is always escaped, so markup shows as text. Binding to innerHTML makes Angular interpret HTML, but it still sanitizes: the Angular guide shows a script element being removed while a harmless bold tag stays.
To opt out, you inject DomSanitizer and call one of five methods: bypassSecurityTrustHtml, bypassSecurityTrustScript, bypassSecurityTrustStyle, bypassSecurityTrustUrl or bypassSecurityTrustResourceUrl. The guide warns that if you trust a value that might be malicious, you introduce a vulnerability, and that if in doubt you should find a professional reviewer.
Match the context
Safety depends on context. Angular defines four security contexts.
| Context | Where it applies | Sanitized by Angular? |
|---|---|---|
| HTML | Binding to innerHTML | Yes |
| Style | Binding CSS to the style property | Not listed: the guide says HTML and URL values are sanitized |
| URL | Properties such as a link href | Yes |
| Resource URL | A URL loaded and run as code, such as a script source | No, because it contains arbitrary code |
Resource URLs cannot be sanitized, which is why a bypass for them deserves the most scrutiny. Trusting a URL value is not the same as trusting an HTML value, so pick the method that fits where the value lands.
A decision checklist
- Where does the value come from? Constants and values built only from your own code are the safest case.
- Can any part of it come from a user, a query string, an API or a CMS? If yes, sanitize first with DomSanitizer.sanitize and the right SecurityContext.
- Is the bypass the narrowest one that works? Prefer the URL method over the HTML one when you only need a link.
- Is the call isolated in one small, reviewed service rather than scattered through components?
- Is there a comment explaining why the value is trusted, so the next reviewer can challenge it?
Auditing an existing app
Search for each of the five method names and for direct DOM access through ElementRef and document, because the guide notes that built-in browser DOM APIs do not protect you unless you enforce Trusted Types. Then consider enforcing Trusted Types: apps that use any bypass method must enable the angular#unsafe-bypass policy, which makes bypass use visible in your headers and easier to audit. See the Angular Trusted Types policy names explained.
Try it yourself
Click through it at your own pace, or open it full screen. Look for how findings group by file, which helps when bypass calls are spread across components.
Safeguard scans a project's dependencies with reachability analysis, and offers a free scan at gold.safeguard.sh/scan.
Quick check
Does bypassSecurityTrustHtml sanitize the value?
No. It marks the value as trusted so Angular leaves it alone. Sanitize beforehand if the source is not fully under your control.
Is it fine to bypass for a URL I built from user input?
Not without validating the scheme and destination. A trusted URL that came from an attacker is still an attack.
Sources
Last reviewed: 19 October 2026.
