v147 · removed · xml · svg · security
Remove Inline XSLT for production of SVG
Chrome 147 removes support for the niche pattern where a raw XML document contains an embedded XSLT stylesheet that transforms the XML into an SVG file. This rolls out in tandem with the new Rust-based XML parser and is separate from the broader XSLT removal planned for Chrome 158.
<?xml-stylesheet?> processing instruction pointing to an XSLT that produces SVG output will stop working in Chrome 147. The usage counter shows this pattern is virtually non-existent on the public web.
at a glance
| Removed in | Chrome 147 (all platforms, stepped rollout) |
|---|---|
| Type | Deprecation and removal |
| Pattern removed | XSLT stylesheet transforming XML → SVG via inline <?xml-stylesheet?> |
| XSLT otherwise | Not removed yet — full XSLT removal is planned for Chrome 158 |
| ChromeStatus | 5143784390262784 — Remove Inline XSLT for production of SVG |
what was removed
An XML file can embed an <?xml-stylesheet?> processing instruction at its top that references an XSL stylesheet. When that stylesheet uses XSLT to output SVG, the browser previously parsed and rendered the result as an SVG document. Chrome 147 removes support for this specific transformation path.
The removal is scoped to the case where XSLT produces SVG. XSLT transforming XML to HTML, or XSLT loaded explicitly via JavaScript, is unaffected by this specific change.
The trigger for this removal is the introduction of the Rust-based XML parser (shipped in Chrome 147 as XML Parsing in Rust for non-XSLT scenarios). Chrome found this pattern was essentially unused on the public web based on usage counters, making it a good candidate to remove before investing effort in supporting it in the new Rust parser.
Source: chromestatus.com/feature/5143784390262784; Removing XSLT for a more secure browsermigration
If you serve XML documents with inline XSLT that outputs SVG, convert the pipeline to generate SVG directly on the server or via JavaScript. Alternatively, use a server-side XSLT processor to produce the SVG before it reaches the browser.
The pattern being removed looks like:
<?xml version="1.0"?>
<?xml-stylesheet type="text/xsl" href="transform-to-svg.xsl"?>
<!-- XML data that XSLT converts to SVG -->
<data>...</data>Chrome 147 will no longer render the resulting SVG. The document may display as raw XML instead.