Microsoft Edge: Browser-native XSLT will be disabled by default

What and Why

Microsoft Edge is deprecating browser-native Extensible Stylesheet Language Transformations (XSLT). Edge will disable the XSLTProcessor JavaScript API and XML processing instructions that reference XSLT stylesheets by default. XML processing instructions that reference CSS stylesheets are not affected.

The native XSLT implementation depends on an aging native codebase that processes untrusted XML and XSLT content. Removing this functionality reduces the browser attack surface. XSLT also has low modern web usage, and safer migration alternatives are available.

Rollout Schedule

General Availability (Worldwide, GCC, GCC High, DoD): We will begin rolling out in mid-December 2026 and expect to complete by mid-December 2026.

Impact on Your Organization

Organizations may be affected if internal websites, public websites, embedded-device interfaces, or third-party web applications depend on browser-native XSLT. In Microsoft Edge 159, browser-native XSLT will be off by default in Stable. The temporary XSLTEnabled policy is planned for removal in Microsoft Edge 176 in Summer 2027.

Action Required/Recommendations

Before Microsoft Edge Stable 159, identify applications that use the XSLTProcessor JavaScript API or XML processing instructions that reference XSL stylesheets. To check for browser-native XSLT usage with Lighthouse in Microsoft Edge:

• Open the application in a current version of Microsoft Edge.
• Sign in and navigate to the application page you want to test.
• Open Edge DevTools with F12 or Ctrl+Shift+I.
• Select the Lighthouse tool. If it isn't visible, select More tools (+) > Lighthouse.
• Select:
• For authenticated applications: In Lighthouse Settings, turn off Clear storage so the audit preserves your signed-in session. Leave it enabled for public pages that don't require stored application state.
• Select Analyze page load.
• In the report:
• Check the DevTools Issues and Console tools for XSLT deprecation warnings.
• Repeat the audit for each relevant page and exercise important application workflows.

• Mode: Navigation
• Category: Best Practices

• Search for XSLT, deprecated, or XSLTProcessor.
• Check for Uses deprecated APIs.
• Expand Issues were logged in the DevTools Issues panel.

Migrate affected applications to supported alternatives or contact the developers/vendor responsible for the affected site to update the application and remove its dependency on browser-native XSLT. If more time is needed, configure the temporary XSLTEnabled policy while application owners complete migration.

Compliance considerations