March 2026 - tor-announce - lists.torproject.org

[SECURITY RELEASE] Tor stable 0.4.8.23 and 0.4.9.6
by David Goulet 25 Mar '26

25 Mar '26

Greetings, We just released today 0.4.8.23 and 0.4.9.6. Here is the announcement: https://forum.torproject.org/t/security-release-0-4-8-23-and-0-4-9-6/21386 Please upgrade as soon as possible if you are running a relay. Change log: Changes in version 0.4.8.23 - 2026-03-25 This is a security release fixing major bugfixes that could possibly lead to remote crashing relays. We strongly recommend upgrading as soon as possible. o Major bugfix (security, conflux): - Fix a memory compare using the wrong length. This could lead to a remote crash when using the conflux subsystem. TROVE-2026-004. Fixes bug 41232; bugfix on 0.4.8.1-alpha. o Minor bugfixes (security): - Fix a series of defense in depth security issues found across the codebase. Fixes bug 41228; bugfix on 0.3.5.1-alpha. o Minor features (fallbackdir): - Regenerate fallback directories generated on March 25, 2026. o Minor features (geoip data): - Update the geoip files to match the IPFire Location Database, as retrieved on 2026/03/25. Changes in version 0.4.9.6 - 2026-03-25 This is a security release fixing major bugfixes that could possibly lead to remote crashing relays. We strongly recommend upgrading as soon as possible. o Major bugfix (security): - Fix a stack overflow of 11 bytes on malicious CREATED2. This lead to a remote crash. TROVE-2026-003. Reported-by: Anas Cherni of Calif.io. Fixes bug 41231; bugfix on 0.4.9.1-alpha. o Major bugfix (security, conflux): - Fix a memory compare using the wrong length. This could lead to a remote crash when using the conflux subsystem. TROVE-2026-004. Fixes bug 41232; bugfix on 0.4.8.1-alpha. o Minor bugfixes (security): - Fix a series of defense in depth security issues found across the codebase. Fixes bug 41228; bugfix on 0.3.5.1-alpha. o Minor bugfixes (portability): - (Hopefully) fix our polyval implementation on big-endian platforms. Fixes bug 41215; bugfix on 0.4.9.3-alpha. o Minor features (fallbackdir): - Regenerate fallback directories generated on March 25, 2026. o Minor features (geoip data): - Update the geoip files to match the IPFire Location Database, as retrieved on 2026/03/25. Cheers! David -- 7Cse8G921+pZrNTPQ6t2z5h5ZO83kH17z68vTK0aSQM=

1 0

New Release: Tor Browser 15.0.8 (Android, Windows, macOS, Linux)
by Giorgio Maone 24 Mar '26

24 Mar '26

Hi everyone, Tor Browser 15.0.8 has now been published for all platforms. For details please see our blog post: - https://blog.torproject.org/new-release-tor-browser-1508 Changelog: # All Platforms * Updated NoScript to 13.6.12.1984 * Bug tor-browser#44663 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44663>: NoScript behavior on “Safer” security level prevents integrity checks for dynamically loaded javascript * Bug tor-browser#44680 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44680>: Properly handle subdocuments created by data: URLs * Bug tor-browser#44761 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44761>: Safer Level's worker patching filters out Worker constructor options * Bug tor-browser#44771 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44771>: Rebase Tor Browser stable onto 140.9.0esr * Bug tor-browser#44784 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44784>: Backport Security Fixes from Firefox 149 * Bug tor-browser-build#41738 <https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/issues/4…>: Allow to specify an unsupportedURL on update responses # Windows + macOS + Linux * Updated Firefox to 140.9.0esr * Bug tor-browser#44327 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44327>: ERROR: Your Tor Browser profile cannot be loaded. It may be missing or inaccessible * Bug tor-browser#44386 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44386>: Firefox profiles no longer work in Tor Browser 15.0 # Linux * Bug tor-browser#44657 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44657>: Backport tor-browser#44394: Do not read default prefs from /etc/firefox # Android * Updated GeckoView to 140.9.0esr # Build System * Windows + Linux + Android o Updated Go to 1.25.8 o Bug tor-browser#44249 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44249>: Backport tor-browser-build#41580: Update Go major to 1.25.x -- ma1

1 0

New Release: Tor Browser 16.0a4 (Android, Windows, macOS, Linux)
by Giorgio Maone 11 Mar '26

11 Mar '26

Hi everyone, Tor Browser 16.0a4 has now been published for all platforms. For details please see our blog post: - https://blog.torproject.org/new-alpha-release-tor-browser-160a4/ <https://blog.torproject.org/new-alpha-release-tor-browser-160a4/> Changelog: # All Platforms * Updated NoScript to 13.6.6.90401984 * Updated zlib to 1.3.2 * Bug tor-browser#44663 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44663>: NoScript behavior on “Safer” security level prevents integrity checks for dynamically loaded javascript * Bug tor-browser#44675 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44675>: Restore "BB 43850: Modify the Contrast Control settings for RFP" dropped during the 148.0a1 rebase * Bug tor-browser#44679 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44679>: Review Mozilla 2006066: Credit cards autofill settings are not visible * Bug tor-browser#44680 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44680>: Properly handle subdocuments created by data: URLs * Bug tor-browser#44687 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44687>: Security level requires a restart in a new profile after 148 update * Bug tor-browser#44689 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44689>: Forwardport tor-browser#44668 from legacy to alpha: Set detailsURL in update XML to be useful for 13.5 users * Bug tor-browser#44701 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44701>: Unexpected change to |netwerk/url-classifier/components.conf| * Bug tor-browser#44706 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44706>: creating a new profiles causes crash ENOTTY * Bug tor-browser-build#41738 <https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/issues/4…>: Allow to specify an unsupportedURL on update responses # Windows + macOS + Linux * Updated Firefox to 148.0a1 * Bug tor-browser#42664 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/42664>: Use mozilla token sizes in CSS * Bug tor-browser#44634 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44634>: Review Mozilla 2006250: add ai window about:preferences section within ai features * Bug tor-browser#44682 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44682>: Wrong pid in the exit log * Bug tor-browser#44709 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44709>: Hide the AI settings panel * Bug tor-browser#44710 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44710>: Hide about:preferences#translations * Bug tor-browser#44713 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44713>: The about dialog is missing some padding in 148.0a1 * Bug tor-browser#44717 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44717>: Search suggestion settings are visible in 148 # Windows + Linux * Bug tor-browser-build#40892 <https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/issues/4…>: Move torrc-defaults, geoip and geoip6 on Windows and Linux # Windows * Bug tor-browser#44461 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44461>: Window controls are missing on Windows * Bug tor-browser#44633 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44633>: Move D3D11 function from local webrtc changes to tbb webrtc patches # Linux * Bug tor-browser#44394 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44394>: Do not read default prefs from /etc/firefox # Android * Updated GeckoView to 148.0a1 * Bug tor-browser#43349 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/43349>: Add user feedback for when Tor connects (Android) * Bug tor-browser#43909 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/43909>: Review Mozilla: TBD: new Android tab-strip feature * Bug tor-browser#44226 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44226>: Disable all link sharing functionality * Bug tor-browser#44274 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44274>: Review Mozilla 1986534: Disable screenshots in PBM * Bug tor-browser#44469 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44469>: Fix branding on Android RR * Bug tor-browser#44506 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44506>: Remove more sync from 147 * Bug tor-browser#44582 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44582>: Fix or remove new settings search functionality on Android * Bug tor-browser#44661 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44661>: Restore or fix new rebase-148 uses of moz assets instead of TB ones * Bug tor-browser#44718 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44718>: Fix splash screen branding and other issues in RR * Bug tor-browser#44721 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44721>: Android build failure in nightlyOssLicensesTask: missing dependencies.json file # Build System * All Platforms o Bug tor-browser-build#41690 <https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/issues/4…>: Merge list_toolchain_updates-firefox-* commands into one o Bug tor-browser-build#41725 <https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/issues/4…>: Update toolchains for Firefox 148 o Bug tor-browser-build#41726 <https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/issues/4…>: Check in list_toolchain_updates that the sha512sum we have for the macOS SDK is the same as Mozilla o Bug tor-browser-build#41727 <https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/issues/4…>: Split the list_toolchain_updates_checks script in two o Bug tor-browser-build#41728 <https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/issues/4…>: Update projects/application-services/list_toolchain_updates_checks to check nss sha256sum * Windows + macOS + Linux o Bug tor-browser#44406 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44406>: Fix CSS linting issues introduced by 146 * Windows + Linux + Android o Updated Go to 1.25.8 * Android o Bug tor-browser-build#41736 <https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/issues/4…>: Add generate_gradle_dependencies_list-$project makefile targets o Bug tor-browser-build#41737 <https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/issues/4…>: Remove comment from gen-gradle-deps-file.py saying var/gradle_dependencies_version should be updated o Bug tor-browser-build#41743 <https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/issues/4…>: Make an error if gradle-dependencies-list is missing in the input files o Bug tor-browser-build#41744 <https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/issues/4…>: Reduce duplication between projects/geckoview/build and projects/geckoview/build_apk o Bug tor-browser-build#41745 <https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/issues/4…>: Add .sh file extension to included build_* scripts in projects/geckoview o Bug tor-browser-build#41751 <https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/issues/4…>: Fix the NDK path -- ma1

1 0