Chromium has announced its intention to deprecate and eventually remove support for XSLT. This decision has been driven by ongoing security vulnerabilities identified within the libxslt library and a noticeable decline in usage, currently standing at a mere 0.05% of all page loads.
The phased deprecation process, beginning with the release of M143 in December 2025, will gradually lead to the complete removal of XSLT in M164 by August 2027. This planned timeline includes the introduction of console warnings starting from October 2025, which will inform developers of the impending change.
To address potential disruptions, a polyfill has been developed, promising to restore XSLT functionality for up to 82% of affected websites. Additionally, origin trials and specific enterprise policies will be available, offering extended support for those unable to transition immediately.
Current alternatives, as suggested by Chromium, include modern JavaScript frameworks and JSON APIs, which present safer options compared to the outdated XSLTProcessor API and XML stylesheet processing instructions. Developers are encouraged to consider leveraging JavaScript-based XSLT libraries such as Saxonica or implementing a WebAssembly-based polyfill. Those looking for more temporary solutions may explore relevant Chrome extensions that replicate the XSLT functionality.
It is noteworthy that browsers like Firefox and Safari (WebKit) have also signaled their support for the deprecation and removal of XSLT, indicating a broader industry move toward enhanced browser security.
With the collaborative effort across major browsers, the transition away from XSLT aims to mitigate memory safety risks while laying the groundwork for a more secure web browsing environment.

Collections

Chromium will deprecate and remove XSLT support between December 2025 (M143) and August 2027 (M164) due to security vulnerabilities in libxslt and minimal usage (0.05% of page loads). A polyfill will restore functionality for 82% of affected sites, with origin trials and enterprise policies available for extended support. Developers should migrate to modern JavaScript frameworks, JSON APIs, or JavaScript-based XSLT libraries. Firefox and Safari support this industry-wide move toward improved browser security.

Chromium's Plan to Deprecate and Remove XSLT