Chrome to Remove XSLT Support by November 2026 for Security

Chrome Removes XSLT for Security Reasons

Chrome intends to deprecate and remove XSLT from the browser, with support ending in version 158 on November 17, 2026. The XSLTProcessor JavaScript API and the XSLT processing instruction are both affected. Firefox and WebKit have also indicated plans to remove XSLT from their browser engines.

Chrome 143 begins showing deprecation warnings in December 2025, and Canary, Dev, and Beta releases disable XSLT by default starting with Chrome 145. An Enterprise Policy and an Origin Trial will allow continued use past the removal date until Chrome 176 in August 2027.

Why XSLT Is Being Removed

The underlying libraries that process XSLT transformations, such as libxslt used by Chromium, are complex, aging C/C++ codebases susceptible to memory safety vulnerabilities. Security audits have repeatedly identified high-severity vulnerabilities in these parsers. Because client-side XSLT is now rarely used, these libraries receive less maintenance and security scrutiny than core JavaScript engines.

Only about 0.02% of web page loads use XSLT today, with less than 0.001% using XSLT processing instructions. Modern web development relies on the Fetch API, the DOMParser API, and frameworks like React, Vue, and Svelte for rendering data securely within the browser sandbox.

Migration Options

Several migration paths exist. Sites can move XSLT processing to the server side and send rendered HTML to the client, or migrate XML API endpoints to JSON with client-side rendering using JavaScript. The Saxonica library provides full client-side XSLT support, including the v3.0 standard.

A WASM-based polyfill for the XSLTProcessor class is available on GitHub, allowing existing JavaScript code to continue functioning. A Chrome extension is also available that applies the polyfill to all raw XML pages containing XSLT processing instructions, which is useful for applications where the source cannot be changed.

Sources: Chrome for Developers