Posted inMicrosoft 365 suite

MC1509789: Microsoft Edge Disables Browser-Native XSLT by Default to Reduce Security Risks

4 minutesPosted inMicrosoft 365 suite
MWPRO IMPACT SCORE
OPERATIONAL IMPACT
65
0 25 50 75 100
HIGH IMPACT • REVIEW RECOMMENDED
Recommended Action:
Review the update and plan any required actions before rollout.
▶ What is MWPro Impact Score? Watch our 60‑second explainer

Primary Audience

Tenant AdminsMicrosoft 365 AdminsAzure AdminsIT ManagersDevelopersService OwnersSecurity Teams
Why this score?
AI Confidence
HIGH
Enough detail is available to trust this assessment.
Assessment Reasoning
Edge will disable browser-native XSLT by default starting with version 159, affecting any internal or third-party web applications relying on the XSLTProcessor API. Admins must identify and migrate affected apps before the change takes effect or use the temporary XSLTEnabled policy as a short-term workaround. The announcement clearly sets dates and migration guidance, making impact high for admins managing web dependencies but only moderate for end users.
78
🛡️ Admin Impact
CRITICAL
32
👥 User Impact
MEDIUM
68
⚡ Urgency
HIGH
70
🔧 Effort
HIGH
ℹ️ WHAT YOU NEED TO KNOW
📌

AT A GLANCE

Edge will disable browser-native XSLT by default to reduce security risks. Check if any internal or third‑party apps depend on XSLT before rollout.
👥

END USERS

Users may notice older web apps or devices using XSLT fail to display correctly.
🛡️

IT ADMINS

Review and test internal sites or applications for XSLT usage and plan migration before Edge Stable 159.
📅

ROLLOUT TIMELINE

Upcoming:
Mid‑December 2026

📢 Official Microsoft Message Center Announcement

Microsoft Edge: Browser-native XSLT will be disabled by default
Message ID: MC1509789

[What and Why:]

Microsoft Edge is deprecating browser-native Extensible Stylesheet Language Transformations (XSLT). Edge will disable the XSLTProcessor JavaScript API and XML processing instructions that reference XSLT stylesheets by default. XML processing instructions that reference CSS stylesheets are not affected.

The native XSLT implementation depends on an aging native codebase that processes untrusted XML and XSLT content. Removing this functionality reduces the browser attack surface. XSLT also has low modern web usage, and safer migration alternatives are available.

[Rollout Schedule:]

General Availability (Worldwide, GCC, GCC High, DoD): We will begin rolling out in mid-December 2026 and expect to complete by mid-December 2026.

[Impact on Your Organization:]

Organizations may be affected if internal websites, public websites, embedded-device interfaces, or third-party web applications depend on browser-native XSLT. In Microsoft Edge 159, browser-native XSLT will be off by default in Stable. The temporary XSLTEnabled policy is planned for removal in Microsoft Edge 176 in Summer 2027.

[Action Required/Recommendations:]

Before Microsoft Edge Stable 159, identify applications that use the XSLTProcessor JavaScript API or XML processing instructions that reference XSL stylesheets. To check for browser-native XSLT usage with Lighthouse in Microsoft Edge:

  1. Open the application in a current version of Microsoft Edge.
  2. Sign in and navigate to the application page you want to test.
  3. Open Edge DevTools with F12 or Ctrl+Shift+I.
  4. Select the Lighthouse tool. If it isn’t visible, select More tools (+) > Lighthouse.
  5. Select:
    • Mode: Navigation
    • Category: Best Practices
  6. For authenticated applications: In Lighthouse Settings, turn off Clear storage so the audit preserves your signed-in session. Leave it enabled for public pages that don’t require stored application state.
  7. Select Analyze page load.
  8. In the report:
    • Search for XSLT, deprecated, or XSLTProcessor.
    • Check for Uses deprecated APIs.
    • Expand Issues were logged in the DevTools Issues panel.
  9. Check the DevTools Issues and Console tools for XSLT deprecation warnings.
  10. Repeat the audit for each relevant page and exercise important application workflows.

Migrate affected applications to supported alternatives or contact the developers/vendor responsible for the affected site to update the application and remove its dependency on browser-native XSLT. If more time is needed, configure the temporary XSLTEnabled policy while application owners complete migration.

[Compliance considerations:]

QuestionAnswer
Does the change include an admin control?Yes. Admins can temporarily use the XSLTEnabled policy to manage XSLT behavior while migrating affected applications.
Does the change modify or disable a capability?Yes. Browser-native XSLT will be disabled by default and the temporary policy is planned for removal in a future Edge release.

Source: Microsoft Message Center • Analysed by MWPro

Share This Update
Tags: