securityonline.info 12 Oct 2026, 11:26 UTC

Chrome’s XSLT Removal Could Break Windows Server Remote Access Portals

Chrome’s XSLT Removal Could Break Windows Server Remote Access Portals
CyberSIXT Evidence Panel Source marked as original reporting

GOOGLE plans to deprecate client-side XSLT in Chromium browsers, a move that could cause the RD Web Access pages used for Remote Desktop Services on Windows Server to fail to render. The article explains that the RD Web Access portal relies on the browser to perform XSLT transformations, converting server-returned XML into a web interface. With XSLT processing disabled, users may encounter an error message stating that the RD Web Access cannot be displayed and may not see their remote resources.

The piece cites Microsoft support indicating Windows Server 2016, 2019, 2022 and 2025 as affected, with the problem triggered by policy turning off XSLT.

The deprecation is driven by Google’s assessment that client-side XSLT is rare (about 0.02% of page loads) and by concerns over libxslt’s aging codebase and memory-safety risks. The Chrome deprecation plan notes that support ends with Chrome 158, shipping on 17 November. Enterprise policy users and origin trial participants can retain XSLT for a time, but Chrome 176 will remove those policies for good on 17 August 2027, leaving roughly 10 months for migration.

Microsoft’s interim options offered to administrators include re-enabling XSLT by policy, deploying the HTML5 web client, or using IE mode in Edge; the HTML5 web client is described as the safer long-term path. The piece references the Chrome XSLT deprecation plan and provides a brief context for IT teams preparing a transition ahead of the upcoming browser changes.

View full article

Article by CyberSIXT

Timeline Coverage

Swipe to explore timeline