Microsoft and Google are removing client-side XSLT (Extensible Stylesheet Language Transformations) libraries from their browsers due to security concerns and reduced maintenance of legacy components. XSLT is the technology that powers Mosaic forms in the browser. Without it, forms will not display — users will see a blank screen instead of the form content.
If you are using Mosaic 26.1, no action is needed. The 26.1 release has already been updated so that browser-based XSLT is no longer required.
Who is affected
This affects all Mosaic users who are not yet on version 26.1 and use Microsoft Edge or Google Chrome to access Mosaic forms. Both internal users and external customers using Mosaic are impacted.
Key dates
Use the table below to understand the timeline for each browser.
Browser | What is changing | When |
Microsoft Edge 147 | Introduces the XSLTEnabled enterprise policy, allowing XSLT to be enabled or disabled via Group Policy. XSLT remains enabled by default. Microsoft encourages organisations to test the impact of disabling it. | 9 April 2026 (released) |
Microsoft Edge (future) | Full removal of XSLT support. Microsoft has not yet announced a date, but may begin disabling XSLT for some users via remote field trials at any time. | To be confirmed |
Google Chrome M158 | XSLT removed for general users. An Enterprise Policy and Origin Trial will be available to extend support. | ~November 2026 |
Google Chrome M176 | Enterprise Policy and Origin Trial expire. XSLT removed for all users — no further workarounds available. | ~August 2027 |
⚠️ Important: If you are not on Mosaic 26.1, we strongly recommend upgrading before November 2026, when Google Chrome will remove XSLT support for general users. Although Microsoft Edge has not yet set a removal date, it could begin disabling XSLT for some users without notice. Setting the XSLTEnabled Group Policy to Enabled is a recommended precaution.
What happens if no action is taken
When a user opens a Mosaic form in a browser that no longer supports XSLT, the form will not display. The user will see a blank screen and all form data will be inaccessible.
All Mosaic forms are affected. This poses a significant business disruption risk if no mitigation is implemented.
What you need to do
The action you need to take depends on your current version of Mosaic and which browser you use.
If you are on Mosaic 26.1
No action is needed. The changes to remove the dependency on browser-based XSLT have already been implemented in this release.
If you are not on Mosaic 26.1 and use Microsoft Edge
We recommend that your IT team sets the XSLTEnabled Group Policy to Enabled. Although XSLT is currently enabled by default in Edge 147, Microsoft's policy documentation indicates that if this policy is not configured, XSLT availability may be affected by remote field trials — changes Microsoft can push to a subset of users at any time without a browser update. Setting the policy to Enabled protects against this possibility while you plan your upgrade to Mosaic 26.1.
Microsoft have provided instructions for configuring this setting: XSLTEnabled policy documentation.
📌 Note: This is a temporary workaround. Upgrading to Mosaic 26.1 is the permanent solution.
If you use Google Chrome
Chrome will remove XSLT support for general users in approximately November 2026 (Chrome M158). An Enterprise Policy will be available to extend support until approximately August 2027 (Chrome M176), after which XSLT will be removed for all users with no further workarounds available. Upgrading to Mosaic 26.1 before November 2026 will ensure no disruption.
What Access is doing
In response to the removal of XSLT support by both Google Chrome and Microsoft Edge, the Mosaic 26.1 release has been updated so that XSLT functionality in the browser is no longer needed. Customers on Mosaic 26.1 are fully protected from these browser changes.