)]}'
{"id": 5309598397497344, "name": "XML parsing in Rust for non-XSLT scenarios", "summary": "To improve browser security and protect users against memory-related vulnerabilities, Chrome 153 updates its XML parsing engine to a memory-safe [Rust](https://rust-lang.org/) implementation for several common scenarios. This foundational update eliminates potential memory corruption bugs while maintaining full compatibility with existing web standards.\n\nChrome has already begun to deprecate and remove [XSLT](https://www.w3.org/TR/xslt-30/). While this process continues, the new, safer parser will handle the following scenarios where no XSLT is required:\n\n1. DOMParser Web API.\n2. Accessing responseXML of XMLHttpRequest.\n3. SVG standalone images (that is, accessing a `image.svg` document directly as a top level navigation).\n4. SVG external images (including a main document embedding an SVG as an external image resource).\n", "markdown_fields": ["summary"], "blink_components": ["Blink>DOM"], "star_count": 97, "search_tags": ["xml", "security", "parsing", "parser"], "created": {"by": "drott@chromium.org", "when": "2026-02-09 17:20:48.281157"}, "updated": {"by": "siobhankeating@google.com", "when": "2026-08-26 11:54:44.639552"}, "category": "DOM", "category_int": 5, "feature_notes": null, "web_feature": null, "is_official_web_feature": null, "webdx_usecounter_enum": null, "enterprise_feature_categories": ["2"], "enterprise_product_category": 0, "is_releasenotes_content_reviewed": true, "is_releasenotes_publish_ready": true, "stages": [{"id": 4819163396833280, "created": "2026-02-09 17:20:48.807193", "feature_id": 5309598397497344, "stage_type": 320, "display_name": null, "intent_stage": 1, "pm_emails": [], "tl_emails": [], "ux_emails": [], "te_emails": [], "intent_thread_url": null, "announcement_url": null, "experiment_goals": null, "experiment_risks": null, "origin_trial_id": null, "origin_trial_feedback_url": null, "ot_action_requested": false, "ot_approval_buganizer_component": null, "ot_approval_buganizer_custom_field_id": null, "ot_approval_criteria_url": null, "ot_approval_group_email": null, "ot_chromium_trial_name": null, "ot_description": null, "ot_display_name": null, "ot_documentation_url": null, "ot_emails": [], "ot_feedback_submission_url": null, "ot_has_third_party_support": false, "ot_is_critical_trial": false, "ot_is_deprecation_trial": false, "ot_owner_email": null, "ot_requester_email": null, "ot_require_approvals": false, "ot_use_counter_bucket_number": null, "ot_webfeature_use_counter": null, "extensions": [], "experiment_extension_reason": null, "ot_stage_id": null, "finch_url": null, "rollout_milestone": null, "rollout_platforms": [], "rollout_details": null, "rollout_impact": 2, "rollout_stage_plan": null, "enterprise_policies": [], "desktop_first": null, "android_first": null, "ios_first": null, "webview_first": null, "desktop_last": null, "android_last": null, "ios_last": null, "webview_last": null}, {"id": 6540474083049472, "created": "2026-02-09 17:20:48.860847", "feature_id": 5309598397497344, "stage_type": 330, "display_name": null, "intent_stage": 2, "pm_emails": [], "tl_emails": [], "ux_emails": [], "te_emails": [], "intent_thread_url": null, "announcement_url": null, "experiment_goals": null, "experiment_risks": null, "origin_trial_id": null, "origin_trial_feedback_url": null, "ot_action_requested": false, "ot_approval_buganizer_component": null, "ot_approval_buganizer_custom_field_id": null, "ot_approval_criteria_url": null, "ot_approval_group_email": null, "ot_chromium_trial_name": null, "ot_description": null, "ot_display_name": null, "ot_documentation_url": null, "ot_emails": [], "ot_feedback_submission_url": null, "ot_has_third_party_support": false, "ot_is_critical_trial": false, "ot_is_deprecation_trial": false, "ot_owner_email": null, "ot_requester_email": null, "ot_require_approvals": false, "ot_use_counter_bucket_number": null, "ot_webfeature_use_counter": null, "extensions": [], "experiment_extension_reason": null, "ot_stage_id": null, "finch_url": null, "rollout_milestone": null, "rollout_platforms": [], "rollout_details": null, "rollout_impact": 2, "rollout_stage_plan": null, "enterprise_policies": [], "desktop_first": null, "android_first": null, "ios_first": null, "webview_first": null, "desktop_last": null, "android_last": null, "ios_last": null, "webview_last": null}, {"id": 6016127144689664, "created": "2026-02-09 17:20:48.915172", "feature_id": 5309598397497344, "stage_type": 360, "display_name": null, "intent_stage": 5, "pm_emails": [], "tl_emails": [], "ux_emails": [], "te_emails": [], "intent_thread_url": "https://groups.google.com/a/chromium.org/g/blink-dev/c/4j2oGg2lyBk/m/r8RA6dhYBQAJ", "announcement_url": null, "experiment_goals": null, "experiment_risks": null, "origin_trial_id": null, "origin_trial_feedback_url": null, "ot_action_requested": false, "ot_approval_buganizer_component": null, "ot_approval_buganizer_custom_field_id": null, "ot_approval_criteria_url": null, "ot_approval_group_email": null, "ot_chromium_trial_name": null, "ot_description": null, "ot_display_name": null, "ot_documentation_url": null, "ot_emails": [], "ot_feedback_submission_url": null, "ot_has_third_party_support": false, "ot_is_critical_trial": false, "ot_is_deprecation_trial": false, "ot_owner_email": null, "ot_requester_email": null, "ot_require_approvals": false, "ot_use_counter_bucket_number": null, "ot_webfeature_use_counter": null, "extensions": [], "experiment_extension_reason": null, "ot_stage_id": null, "finch_url": null, "rollout_milestone": null, "rollout_platforms": [], "rollout_details": null, "rollout_impact": 2, "rollout_stage_plan": null, "enterprise_policies": [], "desktop_first": 153, "android_first": 153, "ios_first": null, "webview_first": 153, "desktop_last": null, "android_last": null, "ios_last": null, "webview_last": null}, {"id": 5287653329207296, "created": "2026-02-09 17:27:56.022266", "feature_id": 5309598397497344, "stage_type": 360, "display_name": null, "intent_stage": 5, "pm_emails": [], "tl_emails": [], "ux_emails": [], "te_emails": [], "intent_thread_url": "https://groups.google.com/a/chromium.org/d/msgid/blink-dev/CAN6muBvUpuf3UBfv6vFxfy-b1LW-fgBbaMk02w5heHDPqbS8dg%40mail.gmail.com", "announcement_url": null, "experiment_goals": null, "experiment_risks": null, "origin_trial_id": null, "origin_trial_feedback_url": null, "ot_action_requested": false, "ot_approval_buganizer_component": null, "ot_approval_buganizer_custom_field_id": null, "ot_approval_criteria_url": null, "ot_approval_group_email": null, "ot_chromium_trial_name": null, "ot_description": null, "ot_display_name": null, "ot_documentation_url": null, "ot_emails": [], "ot_feedback_submission_url": null, "ot_has_third_party_support": false, "ot_is_critical_trial": false, "ot_is_deprecation_trial": false, "ot_owner_email": null, "ot_requester_email": null, "ot_require_approvals": false, "ot_use_counter_bucket_number": null, "ot_webfeature_use_counter": null, "extensions": [], "experiment_extension_reason": null, "ot_stage_id": null, "finch_url": null, "rollout_milestone": null, "rollout_platforms": [], "rollout_details": null, "rollout_impact": 2, "rollout_stage_plan": null, "enterprise_policies": [], "desktop_first": null, "android_first": null, "ios_first": null, "webview_first": null, "desktop_last": null, "android_last": null, "ios_last": null, "webview_last": null}], "accurate_as_of": "2026-08-10 09:07:37.293664", "creator_email": "drott@chromium.org", "updater_email": "siobhankeating@google.com", "owner_emails": ["drott@chromium.org"], "editor_emails": [], "cc_emails": [], "spec_mentor_emails": [], "unlisted": false, "deleted": false, "editors": [], "cc_recipients": [], "spec_mentors": [], "creator": "drott@chromium.org", "feature_type": "No developer-visible change", "feature_type_int": 2, "intent_stage": "None", "intent_stage_int": 0, "active_stage_id": 6016127144689664, "bug_url": "https://crbug.com/466303347", "launch_bug_url": null, "new_crbug_url": "https://bugs.chromium.org/p/chromium/issues/entry?components=Blink>DOM&blocking=466303347&cc=drott@chromium.org", "screenshot_links": [], "first_enterprise_notification_milestone": 150, "enterprise_impact": 2, "breaking_change": false, "confidential": false, "shipping_year": 2026, "flag_name": null, "finch_name": "XMLParsingRust", "non_finch_justification": null, "ongoing_constraints": null, "rollout_plan": 2, "rollout_plan_displayname": "(RARE) Experiment users ramp up over time", "motivation": null, "devtrial_instructions": null, "activation_risks": "No change in behavior means no particular activation risks.", "measurement": "No new behavior that would need adoption measurement. Usage of SVG as external images remains high at about 60% for example,  and will run through this code path.", "availability_expectation": null, "adoption_expectation": null, "adoption_plan": null, "initial_public_proposal_url": null, "explainer_links": [], "requires_embedder_support": false, "spec_link": "https://www.w3.org/TR/xml", "api_spec": false, "automation_spec": false, "interop_compat_risks": "No interoperability risks, the new memory-safe implementation is expected and proven to be functionally equivalent to the C++ based implementation. No functional change. For performance considerations, see ergonomics section. \n\nTwo or three compatibility issues were identified during the experiment phase and have been fixed. \n\nIn the XML parsing Rust crate in upstream, as set of XML conformance tests are run with a good pass rate of test suites, remaining test failures in upstream were investigated and showed that the failures pertain to functionality that we do not use (DTD parsing, for example), or are because of conflicting specifications. \n\nA very low risk of previously unforeseen compatibility issues remains, but I would consider it unlikely.\n", "all_platforms": true, "all_platforms_descr": null, "non_oss_deps": null, "anticipated_spec_changes": null, "security_risks": "This change's main intention is to improve security. Almost all XML parsing we perform will run through the Rust memory-safe parser. When XSLT deprecation concludes, we can deactivate libxml2 XML parsing and move to Rust XML parsing completely.", "ergonomics_risks": "A 1% @ stable experiment was performed. Analysis of the Blink.XMLParsing.NonXsltXmlParsingTime.Combined histogram confirms an isolated parser performance regression. However, guard rail metrics are unaffected on all relevant platforms.\n\nXML parsing becomes slower, more evenly distributed across percentiles on Android between a regression of 36% (50th percentile) and 54% (at the 99th percentile), whereas on Windows, the regression is vastly more pronounced for longer parsing times, 23% at the 25th percentile, to 74% at the 95th percentile, to 209% at the 99th percentile. \n\nStill, in practice in absolute numbers we are talking about parse times reaching only tens of milliseconds on Windows and Android.\n", "wpt": true, "wpt_descr": null, "webview_risks": null, "devrel_emails": ["devrel-chromestatus-all@google.com"], "debuggability": "No change in behavior means no particular activation risks.", "doc_links": [], "sample_links": [], "prefixed": null, "tags": ["xml", "security", "parsing", "parser"], "tag_review": null, "tag_review_status": "Not applicable", "tag_review_status_int": 4, "security_review_status": "Pending", "security_review_status_int": 1, "privacy_review_status": "Pending", "privacy_review_status_int": 1, "security_continuity_id": null, "security_launch_issue_id": null, "updated_display": null, "resources": {"samples": [], "docs": []}, "comments": null, "ff_views": 5, "safari_views": 5, "web_dev_views": 4, "browsers": {"chrome": {"bug": "https://crbug.com/466303347", "blink_components": ["Blink>DOM"], "devrel": ["devrel-chromestatus-all@google.com"], "owners": ["drott@chromium.org"], "origintrial": false, "prefixed": null, "flag": false, "status": {"text": "Proposed", "val": 2, "milestone_str": "Proposed"}, "announced": true, "desktop": 153, "android": 153, "webview": 153, "ios": null}, "ff": {"view": {"url": null, "notes": null, "text": "No signal", "val": 5}}, "safari": {"view": {"url": null, "notes": null, "text": "No signal", "val": 5}}, "webdev": {"view": {"text": "No signals", "val": 4, "url": null, "notes": null}}, "other": {"view": {"text": null, "val": null, "url": null, "notes": null}}}, "standards": {"spec": "https://www.w3.org/TR/xml", "maturity": {"text": null, "short_text": "Unknown status", "val": 0}}, "is_released": false, "is_enterprise_feature": false, "experiment_timeline": null, "ai_test_eval_report": null, "ai_test_eval_run_status": null, "ai_test_eval_status_timestamp": null}