)]}'
{"id": 4709671889534976, "name": "Deprecate and remove XSLT", "summary": "[XSLT v1.0](https://www.w3.org/TR/xslt-10/), which all browsers adhere to, was standardized in 1999. In the meantime, XSLT has evolved to v2.0 and v3.0, adding features, and growing apart from the old version frozen into browsers. This lack of advancement, coupled with the rise of JavaScript libraries and frameworks that offer more flexible and powerful DOM manipulation, has led to a significant decline in the use of client-side XSLT. Its role within the web browser has been largely superseded by JavaScript-based technologies, such as JSON and React.\n\nChromium uses the **libxslt** library to process these transformations, and [libxslt was unmaintained](https://discourse.gnome.org/t/stepping-down-as-libxslt-maintainer/27615) for ~6 months of 2025. Libxslt is a complex, aging C codebase of the type notoriously susceptible to memory safety vulnerabilities like buffer overflows, which can lead to arbitrary code execution. Because client-side XSLT is now a niche, rarely-used feature, these libraries receive far less maintenance and security scrutiny than core JavaScript engines, yet they represent a direct, potent attack surface for processing untrusted web content. Indeed, XSLT is the source of several recent high-profile security exploits that continue to put browser users at risk. \n\nFor these reasons, Chromium (along with both other browser engines, Gecko and WebKit) plans to deprecate and remove XSLT from the web platform. The modern web is powered by three major browser engines: [Blink](https://www.chromium.org/blink/) (Chromium), [Gecko](https://firefox-source-docs.mozilla.org/overview/gecko.html) (Firefox), and [WebKit](https://webkit.org/) (Safari). They interpret code to render pages. \n\nFor more details, see this [Chrome for Developers article](https://developer.chrome.com/docs/web-platform/deprecating-xslt).\n\nFrom Chrome 158, XSLT will stop functioning on Stable releases. ", "markdown_fields": ["summary"], "blink_components": ["Blink>XML"], "star_count": 130, "search_tags": [], "created": {"by": "masonfreed@google.com", "when": "2025-08-01 19:18:08.633405"}, "updated": {"by": "siobhankeating@google.com", "when": "2026-09-10 13:53:50.615492"}, "category": "DOM", "category_int": 5, "feature_notes": null, "web_feature": "xslt", "is_official_web_feature": true, "webdx_usecounter_enum": null, "enterprise_feature_categories": ["1", "2", "3"], "enterprise_product_category": 0, "is_releasenotes_content_reviewed": true, "is_releasenotes_publish_ready": true, "stages": [{"id": 6208862168416256, "created": "2025-08-01 19:18:09.111043", "feature_id": 4709671889534976, "stage_type": 410, "display_name": null, "intent_stage": 1, "pm_emails": [], "tl_emails": [], "ux_emails": [], "te_emails": [], "intent_thread_url": "https://groups.google.com/a/chromium.org/d/msgid/blink-dev/CAM%3DNeDgFVe5xg6usiWHy7ko7X93D2094yf%3DK%3Db7nfD-GJjunkQ%40mail.gmail.com", "announcement_url": null, "experiment_goals": null, "experiment_risks": null, "origin_trial_id": null, "origin_trial_feedback_url": null, "ot_action_requested": false, "ot_approval_buganizer_component": null, "ot_approval_buganizer_custom_field_id": null, "ot_approval_criteria_url": null, "ot_approval_group_email": null, "ot_chromium_trial_name": null, "ot_description": null, "ot_display_name": null, "ot_documentation_url": null, "ot_emails": [], "ot_feedback_submission_url": null, "ot_has_third_party_support": false, "ot_is_critical_trial": false, "ot_is_deprecation_trial": false, "ot_owner_email": null, "ot_requester_email": null, "ot_require_approvals": false, "ot_use_counter_bucket_number": null, "ot_webfeature_use_counter": null, "extensions": [], "experiment_extension_reason": null, "ot_stage_id": null, "finch_url": null, "rollout_milestone": null, "rollout_platforms": [], "rollout_details": null, "rollout_impact": 2, "rollout_stage_plan": null, "enterprise_policies": [], "desktop_first": null, "android_first": null, "ios_first": null, "webview_first": null, "desktop_last": null, "android_last": null, "ios_last": null, "webview_last": null}, {"id": 5074052015980544, "created": "2025-08-01 19:18:09.357599", "feature_id": 4709671889534976, "stage_type": 430, "display_name": null, "intent_stage": 2, "pm_emails": [], "tl_emails": [], "ux_emails": [], "te_emails": [], "intent_thread_url": null, "announcement_url": null, "experiment_goals": null, "experiment_risks": null, "origin_trial_id": null, "origin_trial_feedback_url": null, "ot_action_requested": false, "ot_approval_buganizer_component": null, "ot_approval_buganizer_custom_field_id": null, "ot_approval_criteria_url": null, "ot_approval_group_email": null, "ot_chromium_trial_name": null, "ot_description": null, "ot_display_name": null, "ot_documentation_url": null, "ot_emails": [], "ot_feedback_submission_url": null, "ot_has_third_party_support": false, "ot_is_critical_trial": false, "ot_is_deprecation_trial": false, "ot_owner_email": null, "ot_requester_email": null, "ot_require_approvals": false, "ot_use_counter_bucket_number": null, "ot_webfeature_use_counter": null, "extensions": [], "experiment_extension_reason": null, "ot_stage_id": null, "finch_url": null, "rollout_milestone": null, "rollout_platforms": [], "rollout_details": null, "rollout_impact": 2, "rollout_stage_plan": null, "enterprise_policies": [], "desktop_first": 143, "android_first": 143, "ios_first": null, "webview_first": null, "desktop_last": null, "android_last": null, "ios_last": null, "webview_last": null}, {"id": 5176778372677632, "created": "2025-08-01 19:18:09.436739", "feature_id": 4709671889534976, "stage_type": 450, "display_name": "XSLT", "intent_stage": 3, "pm_emails": [], "tl_emails": [], "ux_emails": [], "te_emails": [], "intent_thread_url": "https://groups.google.com/a/chromium.org/d/msgid/blink-dev/CAM%3DNeDhO%3D2mNq8QyzU5Ah9z8FR6pO9tct9G_prKD6bdtAE7cwA%40mail.gmail.com", "announcement_url": null, "experiment_goals": "The tentative deprecation/removal plan would be as follows:\n\n- M142 (Oct 28, 2025): Early warning console messages added to Chrome.\n- M143 (Dec 2, 2025): Official deprecation of the API - deprecation warning messages begin to show in the console and in lighthouse.\n- M148 (March 10, 2026 Canary): Canary, Dev, and Beta releases begin disabling XSLT by default, as an early-warning.\n- M152 (Aug 25, 2026): Origin Trial (OT) and Enterprise Policy (EP) go live for testing. These allow sites and enterprises to continue using features past the removal date.\n- M158 (Nov 17, 2026): XSLT stops functioning on Stable releases, for all users other than Origin Trial and Enterprise Policy participants.\n- M176 (Aug 17, 2027): Origin Trial and Enterprise Policy stop functioning. XSLT is disabled for all users.\n", "experiment_risks": null, "origin_trial_id": "1902207892610613249", "origin_trial_feedback_url": null, "ot_action_requested": false, "ot_approval_buganizer_component": null, "ot_approval_buganizer_custom_field_id": null, "ot_approval_criteria_url": null, "ot_approval_group_email": null, "ot_chromium_trial_name": "XSLT", "ot_description": "XSLT was deprecated starting in Chrome 143 (Dec, 2025), and support will be disabled by default starting in Chrome 158, around November 17, 2026. This Deprecation Trial will be available starting in Chrome 152, and extending through Chrome 175, which can be used to extend the time a site has to migrate away from XSLT by ~9 months, until August 16, 2027.\n", "ot_display_name": "XSLT", "ot_documentation_url": "https://developer.chrome.com/docs/web-platform/deprecating-xslt", "ot_emails": ["masonf@chromium.org"], "ot_feedback_submission_url": "https://issues.chromium.org/issues/new?component=1456730&template=2210866", "ot_has_third_party_support": true, "ot_is_critical_trial": true, "ot_is_deprecation_trial": true, "ot_owner_email": "masonfreed@google.com", "ot_requester_email": "masonfreed@google.com", "ot_require_approvals": false, "ot_use_counter_bucket_number": null, "ot_webfeature_use_counter": null, "extensions": [], "experiment_extension_reason": null, "ot_stage_id": null, "finch_url": null, "rollout_milestone": null, "rollout_platforms": [], "rollout_details": null, "rollout_impact": 2, "rollout_stage_plan": null, "enterprise_policies": [], "desktop_first": 152, "android_first": 152, "ios_first": null, "webview_first": 152, "desktop_last": 175, "android_last": 175, "ios_last": null, "webview_last": 175, "ot_setup_status": 6}, {"id": 6444833174192128, "created": "2025-08-01 19:18:09.779685", "feature_id": 4709671889534976, "stage_type": 460, "display_name": null, "intent_stage": 5, "pm_emails": [], "tl_emails": [], "ux_emails": [], "te_emails": [], "intent_thread_url": null, "announcement_url": null, "experiment_goals": null, "experiment_risks": null, "origin_trial_id": null, "origin_trial_feedback_url": null, "ot_action_requested": false, "ot_approval_buganizer_component": null, "ot_approval_buganizer_custom_field_id": null, "ot_approval_criteria_url": null, "ot_approval_group_email": null, "ot_chromium_trial_name": null, "ot_description": null, "ot_display_name": null, "ot_documentation_url": null, "ot_emails": [], "ot_feedback_submission_url": null, "ot_has_third_party_support": false, "ot_is_critical_trial": false, "ot_is_deprecation_trial": false, "ot_owner_email": null, "ot_requester_email": null, "ot_require_approvals": false, "ot_use_counter_bucket_number": null, "ot_webfeature_use_counter": null, "extensions": [], "experiment_extension_reason": null, "ot_stage_id": null, "finch_url": null, "rollout_milestone": null, "rollout_platforms": [], "rollout_details": null, "rollout_impact": 2, "rollout_stage_plan": null, "enterprise_policies": [], "desktop_first": null, "android_first": null, "ios_first": null, "webview_first": null, "desktop_last": null, "android_last": null, "ios_last": null, "webview_last": null}, {"id": 6208644333043712, "created": "2025-08-01 19:18:10.351946", "feature_id": 4709671889534976, "stage_type": 470, "display_name": null, "intent_stage": 0, "pm_emails": [], "tl_emails": [], "ux_emails": [], "te_emails": [], "intent_thread_url": null, "announcement_url": null, "experiment_goals": null, "experiment_risks": null, "origin_trial_id": null, "origin_trial_feedback_url": null, "ot_action_requested": false, "ot_approval_buganizer_component": null, "ot_approval_buganizer_custom_field_id": null, "ot_approval_criteria_url": null, "ot_approval_group_email": null, "ot_chromium_trial_name": null, "ot_description": null, "ot_display_name": null, "ot_documentation_url": null, "ot_emails": [], "ot_feedback_submission_url": null, "ot_has_third_party_support": false, "ot_is_critical_trial": false, "ot_is_deprecation_trial": false, "ot_owner_email": null, "ot_requester_email": null, "ot_require_approvals": false, "ot_use_counter_bucket_number": null, "ot_webfeature_use_counter": null, "extensions": [], "experiment_extension_reason": null, "ot_stage_id": null, "finch_url": null, "rollout_milestone": null, "rollout_platforms": [], "rollout_details": null, "rollout_impact": 2, "rollout_stage_plan": null, "enterprise_policies": [], "desktop_first": null, "android_first": null, "ios_first": null, "webview_first": null, "desktop_last": null, "android_last": null, "ios_last": null, "webview_last": null}, {"id": 5096854748528640, "created": "2025-10-20 21:16:23.138986", "feature_id": 4709671889534976, "stage_type": 1061, "display_name": null, "intent_stage": 10, "pm_emails": [], "tl_emails": [], "ux_emails": [], "te_emails": [], "intent_thread_url": null, "announcement_url": null, "experiment_goals": null, "experiment_risks": null, "origin_trial_id": null, "origin_trial_feedback_url": null, "ot_action_requested": false, "ot_approval_buganizer_component": null, "ot_approval_buganizer_custom_field_id": null, "ot_approval_criteria_url": null, "ot_approval_group_email": null, "ot_chromium_trial_name": null, "ot_description": null, "ot_display_name": null, "ot_documentation_url": null, "ot_emails": [], "ot_feedback_submission_url": null, "ot_has_third_party_support": false, "ot_is_critical_trial": false, "ot_is_deprecation_trial": false, "ot_owner_email": null, "ot_requester_email": null, "ot_require_approvals": false, "ot_use_counter_bucket_number": null, "ot_webfeature_use_counter": null, "extensions": [], "experiment_extension_reason": null, "ot_stage_id": null, "finch_url": null, "rollout_milestone": 143, "rollout_platforms": ["1", "3", "5", "6", "7"], "rollout_details": "Deprecation (but not removal) of the APIs.", "rollout_impact": 2, "rollout_stage_plan": 2, "enterprise_policies": [], "desktop_first": 143, "android_first": null, "ios_first": null, "webview_first": null, "desktop_last": null, "android_last": null, "ios_last": null, "webview_last": null}, {"id": 5111440591683584, "created": "2025-10-23 16:47:17.503215", "feature_id": 4709671889534976, "stage_type": 1061, "display_name": null, "intent_stage": 10, "pm_emails": [], "tl_emails": [], "ux_emails": [], "te_emails": [], "intent_thread_url": null, "announcement_url": null, "experiment_goals": null, "experiment_risks": null, "origin_trial_id": null, "origin_trial_feedback_url": null, "ot_action_requested": false, "ot_approval_buganizer_component": null, "ot_approval_buganizer_custom_field_id": null, "ot_approval_criteria_url": null, "ot_approval_group_email": null, "ot_chromium_trial_name": null, "ot_description": null, "ot_display_name": null, "ot_documentation_url": null, "ot_emails": [], "ot_feedback_submission_url": null, "ot_has_third_party_support": false, "ot_is_critical_trial": false, "ot_is_deprecation_trial": false, "ot_owner_email": null, "ot_requester_email": null, "ot_require_approvals": false, "ot_use_counter_bucket_number": null, "ot_webfeature_use_counter": null, "extensions": [], "experiment_extension_reason": null, "ot_stage_id": null, "finch_url": null, "rollout_milestone": 152, "rollout_platforms": ["1", "3", "5", "6", "7"], "rollout_details": "Origin Trial (OT) and Enterprise Policy go live for testing. These allow sites and enterprises to continue using features past the removal date.", "rollout_impact": 2, "rollout_stage_plan": 2, "enterprise_policies": [], "desktop_first": 152, "android_first": null, "ios_first": null, "webview_first": null, "desktop_last": null, "android_last": null, "ios_last": null, "webview_last": null}, {"id": 5197241757335552, "created": "2025-10-23 16:48:07.952334", "feature_id": 4709671889534976, "stage_type": 1061, "display_name": null, "intent_stage": 10, "pm_emails": [], "tl_emails": [], "ux_emails": [], "te_emails": [], "intent_thread_url": null, "announcement_url": null, "experiment_goals": null, "experiment_risks": null, "origin_trial_id": null, "origin_trial_feedback_url": null, "ot_action_requested": false, "ot_approval_buganizer_component": null, "ot_approval_buganizer_custom_field_id": null, "ot_approval_criteria_url": null, "ot_approval_group_email": null, "ot_chromium_trial_name": null, "ot_description": null, "ot_display_name": null, "ot_documentation_url": null, "ot_emails": [], "ot_feedback_submission_url": null, "ot_has_third_party_support": false, "ot_is_critical_trial": false, "ot_is_deprecation_trial": false, "ot_owner_email": null, "ot_requester_email": null, "ot_require_approvals": false, "ot_use_counter_bucket_number": null, "ot_webfeature_use_counter": null, "extensions": [], "experiment_extension_reason": null, "ot_stage_id": null, "finch_url": null, "rollout_milestone": 158, "rollout_platforms": ["1", "3", "5", "6", "7"], "rollout_details": "XSLT stops functioning on Stable releases, for all users other than Origin Trial and enterprise policy participants.", "rollout_impact": 2, "rollout_stage_plan": 2, "enterprise_policies": [], "desktop_first": 158, "android_first": null, "ios_first": null, "webview_first": null, "desktop_last": null, "android_last": null, "ios_last": null, "webview_last": null}, {"id": 5077558198665216, "created": "2025-10-23 16:48:53.187301", "feature_id": 4709671889534976, "stage_type": 1061, "display_name": null, "intent_stage": 10, "pm_emails": [], "tl_emails": [], "ux_emails": [], "te_emails": [], "intent_thread_url": null, "announcement_url": null, "experiment_goals": null, "experiment_risks": null, "origin_trial_id": null, "origin_trial_feedback_url": null, "ot_action_requested": false, "ot_approval_buganizer_component": null, "ot_approval_buganizer_custom_field_id": null, "ot_approval_criteria_url": null, "ot_approval_group_email": null, "ot_chromium_trial_name": null, "ot_description": null, "ot_display_name": null, "ot_documentation_url": null, "ot_emails": [], "ot_feedback_submission_url": null, "ot_has_third_party_support": false, "ot_is_critical_trial": false, "ot_is_deprecation_trial": false, "ot_owner_email": null, "ot_requester_email": null, "ot_require_approvals": false, "ot_use_counter_bucket_number": null, "ot_webfeature_use_counter": null, "extensions": [], "experiment_extension_reason": null, "ot_stage_id": null, "finch_url": null, "rollout_milestone": 176, "rollout_platforms": ["1", "3", "5", "6", "7"], "rollout_details": "Origin Trial and enterprise policy stop functioning. XSLT is disabled for all users.", "rollout_impact": 2, "rollout_stage_plan": 2, "enterprise_policies": [], "desktop_first": 176, "android_first": null, "ios_first": null, "webview_first": null, "desktop_last": null, "android_last": null, "ios_last": null, "webview_last": null}], "accurate_as_of": "2026-08-31 16:14:40.900686", "creator_email": "masonfreed@google.com", "updater_email": "siobhankeating@google.com", "owner_emails": ["masonf@chromium.org"], "editor_emails": ["masonfreed@google.com"], "cc_emails": [], "spec_mentor_emails": [], "unlisted": false, "deleted": false, "editors": ["masonfreed@google.com"], "cc_recipients": [], "spec_mentors": [], "creator": "masonfreed@google.com", "feature_type": "Feature removal", "feature_type_int": 3, "intent_stage": "None", "intent_stage_int": 0, "active_stage_id": 5096854748528640, "bug_url": "https://crbug.com/435623334", "launch_bug_url": null, "new_crbug_url": "https://bugs.chromium.org/p/chromium/issues/entry?components=Blink>XML&blocking=435623334&cc=masonf@chromium.org", "screenshot_links": [], "first_enterprise_notification_milestone": 140, "enterprise_impact": 4, "breaking_change": false, "confidential": false, "shipping_year": 2026, "flag_name": "XSLT", "finch_name": "XSLT", "non_finch_justification": null, "ongoing_constraints": null, "rollout_plan": 0, "rollout_plan_displayname": "Will ship enabled for all users", "motivation": "Security risks for all users outweigh the very small usage of this feature on the open web.\n\nUsage of XSLTProcessor (https://chromestatus.com/metrics/feature/timeline/popularity/79) is fairly volatile, registering somewhere between 0.01% and 0.1% of page loads, averaging around 0.05% over time. These numbers are above the typical 0.001% deprecation threshold. Again, we feel that the increased potential for breakage is balanced by the reduced security risk to 100% of Chromium users. And we are doing everything we can to mitigate this breakage and be proactive in reaching out to potentially affected sites and particularly libraries that might account for significant chunks of the overall usage. In addition, several sites we surveyed that use XSLTProcessor have feature detection code with fallbacks to JS libraries like Saxonica. Of the ~220 sites we've surveyed so far, roughly 72% of them are still functional even with XSLT disabled.\n\nThe usage of XSL Processing Instructions (https://chromestatus.com/metrics/feature/timeline/popularity/78) is significantly lower, around 0.001% for the last few years.", "devtrial_instructions": null, "activation_risks": "See above - the polyfill and extension will ease the migration burden.", "measurement": null, "availability_expectation": null, "adoption_expectation": null, "adoption_plan": null, "initial_public_proposal_url": null, "explainer_links": [], "requires_embedder_support": false, "spec_link": null, "api_spec": false, "automation_spec": false, "interop_compat_risks": "Removal of this feature constitutes a compat risk, since sites that use XSLT will stop working when the feature is removed. Mitigations include a very long deprecation window, a polyfill, lots of outreach, and both origin trials and enterprise policies to allow sites even more time to migrate.\n\nThe polyfill (https://github.com/mfreed7/xslt_polyfill) is specifically built to mimic the existing behavior of Chrome as closely as possible. In most cases, it is a single-line drop-in fix for a lack of XSLT in the browser. According to my analysis, about 75% of sites that hit the use counter don't appear to be visibly broken. Of the 25% that do appear broken in some way (e.g. some components not rendering, or raw XML output instead of transformed HTML), 82% have their functionality restored by the addition of the polyfill. Of the 18% that can't use the polyfill, the primary reason seems to be CORS restrictions, as detailed in the polyfill documentation. And even if site owners take no action, individual users can install the browser extension(https://github.com/mfreed7/xslt_extension), which uses the polyfill, to get back full functionality.", "all_platforms": true, "all_platforms_descr": null, "non_oss_deps": null, "anticipated_spec_changes": null, "security_risks": "This removal constitutes a big win for security, in that it removes a highly-vulnerable external library from Chromium.", "ergonomics_risks": null, "wpt": true, "wpt_descr": "These tests verify the functionality of XSLT. They will need to be changed/removed:\n\nhttps://wpt.fyi/results/dom/xslt", "webview_risks": "In the same way that this poses a compat risk on the open web, it poses a risk for WebView applications.", "devrel_emails": ["devrel-chromestatus-all@google.com"], "debuggability": null, "doc_links": ["https://github.com/whatwg/html/issues/11523"], "sample_links": [], "prefixed": null, "tags": [], "tag_review": null, "tag_review_status": "Not applicable", "tag_review_status_int": 4, "security_review_status": "Pending", "security_review_status_int": 1, "privacy_review_status": "Pending", "privacy_review_status_int": 1, "security_continuity_id": null, "security_launch_issue_id": null, "updated_display": null, "resources": {"samples": [], "docs": ["https://github.com/whatwg/html/issues/11523"]}, "comments": null, "ff_views": 3, "safari_views": 3, "web_dev_views": 5, "browsers": {"chrome": {"bug": "https://crbug.com/435623334", "blink_components": ["Blink>XML"], "devrel": ["devrel-chromestatus-all@google.com"], "owners": ["masonf@chromium.org"], "origintrial": false, "prefixed": null, "flag": false, "status": {"text": "Proposed", "val": 2, "milestone_str": "Proposed"}, "announced": false, "desktop": null, "android": null, "webview": null, "ios": null}, "ff": {"view": {"url": "https://github.com/whatwg/html/issues/11523#issuecomment-3149788558", "notes": null, "text": "Positive", "val": 3}}, "safari": {"view": {"url": "https://github.com/whatwg/html/issues/11523#issuecomment-3149280766", "notes": null, "text": "Positive", "val": 3}}, "webdev": {"view": {"text": "Negative", "val": 5, "url": "https://github.com/whatwg/html/issues/11523#issuecomment-3150969971", "notes": "Existing users of XSLT are understandably negative on this removal, and have been very vocal about it on the standards issue and elsewhere. There are also mixed/positive reactions from some folks in the public discussions, who seem to agree with the removal of XSLT from browsers. But the average/overall developer opinion (as measured by comments on public threads) is negative.\n\nVarious public discussions:\n- https://news.ycombinator.com/item?id=44952185\n- https://www.reddit.com/r/programming/comments/1mxdm22/xslt_removal_will_break_multiple_government_and/\n- https://news.ycombinator.com/item?id=44987346\n- https://news.ycombinator.com/item?id=44987552\n- https://news.ycombinator.com/item?id=44987239\n- https://news.ycombinator.com/item?id=44909599"}}, "other": {"view": {"text": null, "val": null, "url": null, "notes": null}}}, "standards": {"spec": null, "maturity": {"text": null, "short_text": "Unknown status", "val": 0}}, "is_released": false, "is_enterprise_feature": false, "experiment_timeline": null, "ai_test_eval_report": null, "ai_test_eval_run_status": null, "ai_test_eval_status_timestamp": null}