Chromium update disables XSLT 1.0 support, impacting Windows Server RD Web Access
A recent Chromium browser update removes support for the legacy XSLT 1.0 standard, causing compatibility issues for Windows Server Remote Desktop Web Access users.
Key points
- Chromium browsers are dropping support for XSLT 1.0 due to security risks in aging codebases.
- The change impacts a small fraction of web traffic, estimated at just 0.02 percent.
- Windows Server Remote Desktop Web Access functionality is broken by this update.
Chromium-based browsers have removed support for XSLT 1.0 in a recent software update, creating compatibility issues for specific enterprise services. According to a report by Neowin, this change breaks functionality for Windows Server Remote Desktop Web Access, affecting users who rely on this legacy feature for remote connections.
The decision to eliminate XSLT 1.0 stems from underlying security vulnerabilities within the libxslt library, which is written in C and C++. Neowin reports that these aging codebases present a memory safety hazard, prompting browser developers to drop the standard entirely rather than attempt to patch the complex legacy code.
Context and background
The removal of XSLT 1.0 support is driven by the inherent risks associated with maintaining old software components. Libxslt, the library responsible for processing these stylesheets, contains vulnerabilities that are difficult to remediate due to its age and complexity. Memory safety issues in such libraries can lead to serious security breaches, making the complete removal of the feature a more viable security strategy than continued maintenance.
Browser vendors are increasingly prioritizing security over backward compatibility when dealing with obsolete technologies. By eliminating support for standards that pose significant risks, Chromium aims to reduce the attack surface for its users. This move reflects a broader industry trend of deprecating features that are no longer considered safe or necessary for modern web browsing.
Who is affected
The impact of this change is limited to a very small portion of internet traffic. Neowin estimates that only 0.02 percent of traffic relies on XSLT 1.0, indicating that the vast majority of users will not notice any difference. However, for those few users who depend on this technology, the consequences are significant, particularly for enterprise environments using Windows Server Remote Desktop Web Access.
Organizations relying on Remote Desktop Web Access may experience disruptions as the feature fails to function correctly in Chromium-based browsers. This includes systems using Google Chrome, Microsoft Edge, and other browsers built on the Chromium engine. IT administrators should be aware of this potential issue and plan for alternative solutions or browser configurations to maintain access to remote desktop services.
What should you do?
Security professionals and IT administrators should assess their organization's reliance on XSLT 1.0 and Windows Server Remote Desktop Web Access. Identifying systems affected by this change is crucial to minimizing disruption. Organizations should consider alternative methods for remote access or evaluate the feasibility of migrating away from legacy dependencies that are no longer supported by modern browsers.
What to do and how to stay safe: Chromium
- Audit internal web applications and services to identify any reliance on XSLT 1.0 processing.
- Test Windows Server Remote Desktop Web Access functionality in current Chromium-based browser versions.
- Evaluate alternative remote access solutions that do not depend on deprecated browser features.
- Monitor vendor communications for updates or workarounds regarding compatibility issues.
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Why are Chromium browsers removing XSLT 1.0 support?
Chromium is removing XSLT 1.0 support because the underlying libxslt library contains memory safety hazards that are difficult to fix due to its age and complexity.
How many users are affected by this change?
According to Neowin, only about 0.02 percent of web traffic is affected by the removal of XSLT 1.0 support, indicating a very small user base is impacted.
Which specific service is broken by this update?
The update breaks functionality for Windows Server Remote Desktop Web Access, preventing users from accessing remote desktops through this specific web interface.
