Microsoft Edge: Browser-native XSLT will be disabled by default

Microsoft Edge will disable browser-native XSLT by default starting mid-December 2026 to reduce security risks. Organizations should identify and migrate affected applications before Edge Stable 159. A temporary XSLTEnabled policy will be available but removed by Edge 176 in Summer 2027. What and Why: Microsoft Edge is deprecating browser-native Extensible Stylesheet Language Transformations (XSLT). Edge will disable the XSLTProcessor JavaScript API and XML processing instructions that reference XSLT stylesheets by default. XML processing instructions that reference CSS stylesheets are not affected. The native XSLT implementation depends on an aging native codebase that processes untrusted XML and XSLT content. Removing this functionality reduces the browser attack surface. XSLT also has low modern web usage, and safer migration alternatives are available. Rollout Schedule: General Availability (Worldwide, GCC, GCC High, DoD): We will begin rolling out in mid-December 2026 and expect to complete by mid-December 2026. Impact on Your Organization: Organizations may be affected if internal websites, public websites, embedded-device interfaces, or third-party web applications depend on browser-native XSLT. In Microsoft Edge 159, browser-native XSLT will be off by default in Stable. The temporary XSLTEnabled policy is planned for removal in Microsoft Edge 176 in Summer 2027. Action Required/Recommendations: Before Microsoft Edge Stable 159, identify applications that use the XSLTProcessor JavaScript API or XML processing instructions that reference XSL stylesheets. To check for browser-native XSLT usage with Lighthouse in Microsoft Edge: Open the application in a current version of Microsoft Edge. Sign in and navigate to the application page you want to test. Open Edge DevTools with F12 or Ctrl+Shift+I. Select the Lighthouse tool. If it isn’t visible, select More tools (+) > Lighthouse. Select: Mode: Navigation Category: Best Practices For authenticated applications: In Lighthouse Settings, turn off Clear storage so the audit preserves your signed-in session. Leave it enabled for public pages that don’t require stored application state. Select Analyze page load. In the report: Search for XSLT, deprecated, or XSLTProcessor. Check for Uses deprecated APIs. Expand Issues were logged in the DevTools Issues panel. Check the DevTools Issues and Console tools for XSLT deprecation warnings. Repeat the audit for each relevant […]

The post Microsoft Edge: Browser-native XSLT will be disabled by default appeared first on M365 Admin.