Trusted Types make the browser reject plain strings at DOM injection sinks like innerHTML, demanding a vetted typed value instead. Switched on with two CSP directives, it neutralises a whole class of DOM-based XSS.
MDN — Content-Security-Policy: require-trusted-types-for
OWASP — DOM based XSS Prevention Cheat Sheet