DOM.sanitize() is a browser-side helper used to clean HTML before it is inserted into the page. Its job is to remove dangerous markup, such as script-bearing attributes or other active content, so untrusted text can be rendered safely. In mapping libraries and similar UI components, this matters because credits, labels, or metadata are often shown inside the trusted web page origin.
Sanitizers are a common defense against cross-site scripting, but they must inspect the exact content that will be rendered. A subtle bug can appear when the code walks a live DOM collection while mutating it, because items may shift and a malicious attribute can survive the cleanup. If that happens, the browser may later interpret the leftover markup as executable code. Defensive use of DOM.sanitize() means validating untrusted input, snapshotting collections before editing them, and preferring plain text over HTML whenever possible.