Chrome 158 reaches early stable on 4 November 2026 and full stable on 17 November. On that release, client-side XSLT stops working. Not deprecated, not flag-gated: removed. Firefox and WebKit have both signalled positive on the same removal, so there is no browser left to fall back to.
Chrome’s own justification leans on usage. The chromestatus entry puts XSLTProcessor at 0.01% to 0.1% of page loads and XSL processing instructions at “around 0.001% for the last few years”. Those are page-load numbers, and page loads are the wrong denominator for a deprecation that fires on whatever your server happens to be emitting. So we measured the other number: how much XSLT is actually deployed on the Irish web, and what the 17 November fallback looks like when you render it in a real browser.
TL;DR
- We probed 174 Irish domains. 140 answered, 118 served at least one XML document, and 43 of those still ship an
<?xml-stylesheet?>XSLT instruction that Chrome deletes in under a month. - Chrome 155 already prints a console deprecation warning on 41 of them, but a visible on-page banner on only 32. Eight transform cleanly with no notice to anyone looking at the page.
- We rendered every one of them twice in headless Chrome 155, with XSLT on and off. 42 of 43 lose the transform. Most degrade to Chrome’s raw XML tree view with an explanatory message.
- 22 of 69 Drupal sitemap documents render a completely blank page instead, with no message at all. We isolated the trigger to
<xhtml:link hreflang>alternates, which is exactly what bilingual Irish and English public-sector sites emit. - One site is already broken: barnardos.ie points its sitemap stylesheet at a different host to the sitemap, so Chrome has been blocking it and serving a blank page for an unknown period.
- Zero of the 41 stylesheets we resolved were missing or malformed. The exposure is not rot, it is a dependency nobody has inventoried.
What we measured, and how
The corpus was 174 Irish domains: 100 commercial sites (national media, banks, telcos, utilities, retail, transport, insurance, property) and 76 public-sector, regulatory, higher-education, charity and professional-body sites, plus our own four properties. For each domain we fetched the homepage, read robots.txt for declared sitemaps, and probed eleven conventional paths (/sitemap.xml, /sitemap_index.xml, /wp-sitemap.xml, /feed/, /rss.xml and so on). Where a sitemap index carried no stylesheet instruction we followed one level down into its children.
Every XML document we retrieved was scanned for an <?xml-stylesheet?> processing instruction in its prolog. Each distinct stylesheet URL was then resolved on its own to confirm it existed and actually contained an xsl:stylesheet root.
Then the part that matters. We downloaded Chrome for Testing 155.0.8059.79 and drove it with Puppeteer, loading each affected document twice: once normally, once with --disable-blink-features=XSLT. We verified that flag does what it claims by running the same page with a deliberately bogus feature name as a control; the bogus flag changed nothing, the real one changed everything. Detection of a successful transform used the presence of Chrome’s own XML tree viewer wrapper (#webkit-xml-viewer-source-xml) as the negative signal, with document content type and root element as corroboration.
One method note worth stealing: our first pass used Puppeteer’s domcontentloaded and reported zero successful transforms across the board. The XSLT transform completes after DOMContentLoaded. Waiting on load fixed it. If you build a similar check and it tells you nothing works, check that first.
The findings
| Measurement | Result |
|---|---|
| Irish domains probed | 174 |
| Reachable (homepage 2xx or 3xx) | 140 |
| Served at least one XML document | 118 |
| Shipping an XSLT processing instruction | 43 |
Declared type="text/xsl" |
42 of 43 (one declares text/xml) |
| Stylesheet URLs resolved, 200 and genuine XSLT | 41 of 41 |
| Distinct content types used to serve those stylesheets | 5, including application/octet-stream and one with no header at all |
| Transformed successfully in Chrome 155 today | 40 |
| Emitted a console deprecation warning | 41 |
| Showed a visible on-page warning | 32 |
| Lost the transform with XSLT disabled | 42 of 43 |
| Rendered a blank page with XSLT disabled | 22 of 69 Drupal sitemap documents |
By generator, the 43 break down as 23 Yoast SEO, nine Drupal simple_sitemap, three WordPress core, two All in One SEO, one SmartCrawl and one Squirrly SEO, with four unidentified. The Yoast file is the single biggest contributor and it is byte-identical across every site using it, all 4,171 bytes of it. This is not 43 teams who each chose XSLT. It is four or five plugins, installed once, years ago.
Chrome’s warning does not reach everyone
Chrome 155 does two things on an XSLT page. It logs to the console, and it injects a visible paragraph into the output: “This site uses XSLT; that functionality is being removed from this browser very soon. When that happens, this page will likely no longer display correctly.” That is a genuinely good deprecation notice, and on 32 of the 41 sites we could measure, it appears.
On eight it does not. Every one of those eight runs Drupal’s simple_sitemap, whose stylesheet builds its output from strict templates and silently discards the node Chrome injects. The console message still fires. The page looks perfect. Among the eight: the Data Protection Commission, HIQA, the National Library, Sport Ireland, the ESRI, Dublin City Council, the University of Limerick and the Irish Cancer Society.
This is the pattern worth generalising beyond XSLT. A browser deprecation warning is rendered through your stack, and your stack can eat it. The console is the reliable channel; the page is not. If your deprecation process is “we would notice if something looked wrong”, you have no process.
The blank page, and why Irish state sites get the worst of it
With XSLT disabled, most documents fall back gracefully. Chrome shows its XML tree viewer with the line “This document cannot be formatted as intended. It uses XSLT, which the browser does not support.” Ugly, but informative.
Two sites in the first sweep did not do that. dataprotection.ie and nli.ie returned document.body === null, no viewer, no message: a blank white page, consistently across repeated runs. Walking the children of all nine Drupal sitemaps raised the count to 22 affected documents out of 69, across dataprotection.ie, nli.ie, hiqa.ie, dublincity.ie, ul.ie and sportireland.ie.
We ruled out the obvious causes. It is not document size: a 356 KB document with 2,000 URLs got the viewer while a 504 KB one with 940 did not, and a 2.8 MB one with 17,162 URLs got it too. It is not an enforced Content-Security-Policy: one blank site has a CSP with no fetch directives at all, and one working site has a 4 KB enforced policy.
It is the XHTML namespace. We served three synthetic sitemaps from localhost, all with an unresolvable stylesheet instruction: one plain, one declaring xmlns:xhtml without using it, and one containing actual <xhtml:link rel="alternate" hreflang="ga"> elements. The plain one got the viewer. The declaration-only one got the viewer. The one with real XHTML-namespaced elements rendered blank. Chrome will not apply its XML tree viewer to a document containing XHTML content, and <xhtml:link> renders nothing visible, so you get an empty page.
Which means the trigger is hreflang alternates in a sitemap. Which means the Irish sites that get the silent, message-free failure are precisely the ones publishing in Irish as well as English. A statutory language obligation, expressed correctly in a sitemap, selects the worse of two browser fallbacks. Nobody designed that; it is what happens when three independent decisions meet in production.
Two sites where the removal is not the problem
barnardos.ie is already broken. Its sitemap is served from www.barnardos.ie but the stylesheet instruction hard-codes //barnardos.ie/.... Both hosts return 200 for both files, but XSLT stylesheets must be same-origin, so Chrome refuses: “Unsafe attempt to load URL … Domains, protocols and ports must match.” The result today, in current Chrome, is a blank page. One character of protocol-relative URL and a missing www. For this site, 17 November changes nothing, because the thing that breaks already has.
For dcu.ie, the removal is a fix. Its sitemap is a single 2.82 MB document with 17,162 URLs. With XSLT enabled we could not load it at all: it exceeded 45 seconds, then 60, then a 300-second ceiling. With XSLT disabled it loaded in 4.0 seconds. The transform, not the transfer, is the cost. That is one site in our corpus where deleting XSLT is a 75-fold improvement, and it is a useful corrective to reading every deprecation as pure loss.
One incidental finding while walking those children: cancer.ie’s /sitemap.xml is a <sitemapindex> whose 6,284 <loc> entries are content pages rather than sitemap files. Crawlers are told to treat each of those as a sitemap. That has nothing to do with XSLT and is worth more to them than anything in this post.
We are on the list too
Two of our four properties ship the instruction. reptile.haus serves it via Squirrly SEO and praguers.com via WordPress core; micadora.eu and blog.satosh.ie do not. Both of ours transform today, both show Chrome’s warning, and both degrade to the XML tree viewer rather than a blank page on 17 November. We found this by running the same probe against ourselves, which is the only reason we can report it, and it is the second time this quarter that auditing our own estate has turned up something we would not have gone looking for. The first time was worse.
What to actually do before 4 November
- Grep what you emit, not what you wrote.
curl -s https://yoursite/sitemap.xml | head -2answers it in one line. Plugins add this instruction; your repository will not mention it. - Check the stylesheet is same-origin with the document. Protocol-relative hrefs plus a
wwwredirect is the barnardos.ie failure, and it fails today. - If your sitemap carries
hreflangalternates, expect a blank page, not raw XML. Decide whether that is acceptable before someone reports it as a site outage. - Watch the console, not the page. Any deprecation audit that relies on visual inspection will miss the cases where your own templates discard the warning.
- Separate sitemaps from product surfaces. A styled sitemap is cosmetic. Client-side
XSLTProcessorcalls in application code are not, and Chrome’s own survey found roughly 28% of the sites it checked genuinely stop working. Server-side XSLT is unaffected; this is a browser removal only. - Diarise 4 November, not 17 November. Early stable is where your first support ticket comes from.
Method and caveats
Single-run measurements taken on 18 October 2026 from one Irish-facing vantage point. 34 of 174 domains refused us outright with 403s or connection failures, mostly behind WAFs, so the true deployed count is higher than 43, not lower. One site (olympics.ie) served a bot-challenge page instead of its sitemap and is excluded from the render results. Chrome for Testing 155.0.8059.79 headless shell is not byte-identical to Chrome 158; --disable-blink-features=XSLT simulates the removal rather than reproducing it, which is why we ran the bogus-flag control. The 22 blank-page documents are those we reached by following one level of sitemap index, capped at 40 children per site, so that figure is a floor.
The broader point survives all of those caveats. Chrome measured XSL processing instructions at 0.001% of page loads and concluded the feature was niche. Against the right denominator, 36% of the Irish sites in our corpus that serve any XML at all are shipping one. Usage frequency and deployment surface are different quantities, and deprecation timelines are set using the first while the breakage lands on the second. We have made the same measurement mistake on browser feature support and on pinned CI dependencies, and the fix is the same each time: measure your own estate rather than reading someone else’s percentage.
REPTILEHAUS builds and maintains web platforms, and this kind of sweep is a standard part of how we take over a codebase: inventory what the stack emits, not what the team believes it emits. If you want someone to run it across your estate before November, or you have inherited a system nobody can fully describe, get in touch.
📷 Photo by Chris Ried on Unsplash
