The problem
Try to programmatically trigger a typeahead dropdown with JavaScript's dispatchEvent() and you'll hit a wall. The value appears in the input box. Nothing else happens. The dropdown stays closed.
You're fighting isTrusted, a read-only property in the Event interface. It's been in browsers since DOM Level 3. Modern Chrome, Firefox, Safari, and Edge support it fully. IE11 partially.
How it works
isTrusted: true means the browser's user agent generated the event. Real mouse clicks. Physical keystrokes.
isTrusted: false means a script dispatched it via EventTarget.dispatchEvent(). You can't manually set it to true.
This blocks clickjacking attacks and malicious scripts that try to fake user actions. Extension virtual keyboards, for example. Or scripts attempting unauthorized redirects.
It also breaks legitimate automation. Testing frameworks. Electron apps with programmatic TV controls. Monitoring tools like Dynatrace Clickpaths.
The enterprise workaround
Playwright and Cypress don't try to fake isTrusted events. They use Chrome DevTools Protocol to inject events directly into the browser's hardware input pipeline. The browser sees them as real user actions. isTrusted returns true.
This works for test automation at scale. For one-off development problems, work with your framework's reactive system instead of fighting the DOM. Update the data model directly. Let the framework handle the UI updates.
The debate
Some developers argue isTrusted is overly restrictive for desktop apps where clickjacking risks don't apply. Workarounds exist using IPC keyboard events.
Others question its reliability. A Hacker News thread notes form submit events can gain isTrusted: true through bubbling from untrusted button clicks. MDN documentation acknowledges click exceptions in some user agents.
Still, it's standard browser security. If you're building enterprise web apps or testing infrastructure, you need to account for it. Either use CDP-based tools or work within framework constraints.
The lesson: when the browser says no, find the approved path. Don't try to lie to the security layer.