MC1509789 - Microsoft Edge: Browser-native XSLT will be disabled by default

Microsoft 365 Message Center announcement MC1509789.

MS Message Center's Summary

Microsoft Edge will disable browser native XSLT by default starting mid December 2026 to reduce security risks. Organisations should identify internal web applications relying on the XSLTProcessor API or XML processing instructions and migrate them before the feature is removed completely. Administrators can configure a temporary policy if extra time is required for application updates.

Administrator impact
Administrators must audit web applications for XSLT dependencies and plan code migrations or apply temporary policies before complete feature removal.
End user impact
Users might experience rendering failures on internal or third party websites that still depend on browser native XSLT.
Importance
6/10: This change disables browser native functionality by default and can break web applications relying on legacy XSLT.

Microsoft Summary

Microsoft Edge will disable browser-native XSLT by default starting mid-December 2026 to reduce security risks. Organizations should identify and migrate affected applications before Edge Stable 159. A temporary XSLTEnabled policy will be available but removed by Edge 176 in Summer 2027.

Message Center ID
MC1509789
Category
plan For Change
Severity
normal
Services
Microsoft 365 suite
Tags
User impact, Admin impact, Retirement
Published
2026-10-15
Last updated
2026-10-15
Expires
2027-02-15

[What and Why:] Microsoft Edge is deprecating browser-native Extensible Stylesheet Language Transformations (XSLT). Edge will disable the XSLTProcessor JavaScript API and XML processing instructions that reference XSLT stylesheets by default. XML processing instructions that reference CSS stylesheets are not affected. The native XSLT implementation depends on an aging native codebase that processes untrusted XML and XSLT content. Removing this functionality reduces the browser attack surface. XSLT also has low modern web usage, and safer migration alternatives are available. [Rollout Schedule:] General Availability (Worldwide, GCC, GCC High, DoD): We will begin rolling out in mid-December 2026 and expect to complete by mid-December 2026. [Impact on Your Organization:] Organizations may be affected if internal websites, public websites, embedded-device interfaces, or third-party web applications depend on browser-native XSLT. In Microsoft Edge 159, browser-native XSLT will be off by default in Stable. The temporary XSLTEnabled policy is planned for removal in Microsoft Edge 176 in Summer 2027. [Action Required/Recommendations:] Before Microsoft Edge Stable 159, identify applications that use the XSLTProcessor JavaScript API or XML processing instructions that reference XSL stylesheets. To check for browser-native XSLT usage with Lighthouse in Microsoft Edge: Open the application in a current version of Microsoft Edge . Sign in and navigate to the application page you want to test. Open Edge DevTools with F12 or Ctrl+Shift+I . Select the Lighthouse tool. If it isn't visible, select More tools ( + ) > Lighthouse . Select: Mode: Navigation Category: Best Practices For authenticated applications: In Lighthouse Settings , turn off Clear storage so the audit preserves your signed-in session. Leave it enabled for public pages that don't require stored application state. Select Analyze page load . In the report: Search for XSLT , deprecated , or XSLTProcessor . Check for Uses deprecated APIs . Expand Issues were logged in the DevTools Issues panel . Check the DevTools Issues and Console tools for XSLT deprecation warnings. Repeat the audit for each relevant page and exercise important application workflows. Migrate affected applications to supported alternatives or contact the developers/vendor responsible for the affected site to update the application and remove its dependency on browser-native XSLT. If more time is needed, configure the temporary XSLTEnabled policy while application owners complete migration. [Compliance considerations:] Question Answer Does the change include an admin control? Yes. Admins can temporarily use the XSLTEnabled policy to manage XSLT behavior while migrating affected applications. Does the change modify or disable a capability? Yes. Browser-native XSLT will be disabled by default and the temporary policy is planned for removal in a future Edge release.