document.implementation

You can use this to load untrusted third-party content and strip it of dangerous tags and attributes before including it iinnto your own document.
Kind of a sandbox

function parseHTML(str) {
  const frag = doc.implementation.createHTMLDocument(null);
  frag.body.innerHTML = str;
  return frag.body.childNodes;
 }