← Back to release summary

XML parsing in Rust for non-XSLT scenarios

Category
DOM
Type
No developer-visible change
Status
Proposed (Chrome Proposed)
Intent stage
None

Summary

To improve browser security and protect users against memory-related vulnerabilities, Chrome 153 updates its XML parsing engine to a memory-safe [Rust](https://rust-lang.org/) implementation for several common scenarios. This foundational update eliminates potential memory corruption bugs while maintaining full compatibility with existing web standards. Chrome has already begun to deprecate and remove [XSLT](https://www.w3.org/TR/xslt-30/). While this process continues, the new, safer parser will handle the following scenarios where no XSLT is required: 1. DOMParser Web API. 2. Accessing responseXML of XMLHttpRequest. 3. SVG standalone images (that is, accessing a `image.svg` document directly as a top level navigation). 4. SVG external images (including a main document embedding an SVG as an external image resource).

Standards & signals

View on chromestatus.com