MC1509789Microsoft Edge: Browser-native XSLT will be disabled by default
Summary
Microsoft Edge will disable browser-native XSLT by default starting mid-December 2026 to reduce security risks. Organizations should identify and migrate affected applications before Edge Stable 159. A temporary XSLTEnabled policy will be available but removed by Edge 176 in Summer 2027.
More information
What and Why:
Microsoft Edge is deprecating browser-native Extensible Stylesheet Language Transformations (XSLT). Edge will disable the XSLTProcessor JavaScript API and XML processing instructions that reference XSLT stylesheets by default. XML processing instructions that reference CSS stylesheets are not affected.
The native XSLT implementation depends on an aging native codebase that processes untrusted XML and XSLT content. Removing this functionality reduces the browser attack surface. XSLT also has low modern web usage, and safer migration alternatives are available.
Rollout Schedule:
General Availability (Worldwide, GCC, GCC High, DoD): We will begin rolling out in mid-December 2026 and expect to complete by mid-December 2026.
Impact on Your Organization:
Organizations may be affected if internal websites, public websites, embedded-device interfaces, or third-party web applications depend on browser-native XSLT. In Microsoft Edge 159, browser-native XSLT will be off by default in Stable. The temporary XSLTEnabled policy is planned for removal in Microsoft Edge 176 in Summer 2027.
Action Required/Recommendations:
Before Microsoft Edge Stable 159, identify applications that use the XSLTProcessor JavaScript API or XML processing instructions that reference XSL stylesheets. To check for browser-native XSLT usage with Lighthouse in Microsoft Edge:
- Open the application in a current version of Microsoft Edge.
- Sign in and navigate to the application page you want to test.
- Open Edge DevTools with F12 or Ctrl+Shift+I.
- Select the Lighthouse tool. If it isn't visible, select More tools (
+) > Lighthouse. - Select:
- Mode: Navigation
- Category: Best Practices
- For authenticated applications: In Lighthouse Settings, turn off Clear storage so the audit preserves your signed-in session. Leave it enabled for public pages that don't require stored application state.
- Select Analyze page load.
- In the report:
- Search for XSLT, deprecated, or XSLTProcessor.
- Check for Uses deprecated APIs.
- Expand Issues were logged in the DevTools Issues panel.
- Check the DevTools Issues and Console tools for XSLT deprecation warnings.
- Repeat the audit for each relevant page and exercise important application workflows.
Migrate affected applications to supported alternatives or contact the developers/vendor responsible for the affected site to update the application and remove its dependency on browser-native XSLT. If more time is needed, configure the temporary XSLTEnabled policy while application owners complete migration.
Compliance considerations:
| Question | Answer |
| Does the change include an admin control? | Yes. Admins can temporarily use the XSLTEnabled policy to manage XSLT behavior while migrating affected applications. |
| Does the change modify or disable a capability? | Yes. Browser-native XSLT will be disabled by default and the temporary policy is planned for removal in a future Edge release. |