May 2026 - tor-announce - lists.torproject.org

New Release: Tor Browser 15.0.14 (Android, Windows, macOS, Linux)
by Giorgio Maone 19 May '26

19 May '26

Hi everyone, Tor Browser 15.0.14 has now been published for all platforms. For details please see our blog post <https://blog.torproject.org/new-release-tor-browser-15014/>. * All Platforms o Bug tor-browser#44958 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44958>: Backport Security Fixes from Firefox 151 * Windows + macOS + Linux o Updated Firefox to 140.11.0esr * Android o Updated GeckoView to 140.11.0esr * Build System o All Platforms + Bug tor-browser-build#41781 <https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/issues/4…>: Fix clean section in rbm.local.conf.example + Bug tor-browser-build#41798 <https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/issues/4…>: Update the URL to versions.ini in relprep.py o Windows + Linux + Android + Updated Go to 1.25.10 -- ma1

1 0

New Release: Tor Browser 15.0.13 (Android, Windows, macOS, Linux)
by Morgan 07 May '26

07 May '26

Hi everyone, Tor Browser 15.0.13 has now been published for all platforms. For details please see our blog post: - https://blog.torproject.org/new-release-tor-browser-15013/ Changelog: > * All Platforms > * Updated tor to 0.4.9.8 > * Updated NoScript to 13.6.19.1984 best, -morgan

1 0

[RELEASE] Tor stable 0.4.8.25 and 0.4.9.8
by David Goulet 07 May '26

07 May '26

Greetings, Due to an error in the previous releases (0.4.8.24 and 0.4.9.7), we had to quickly release a new version today. Here is the announcement: https://forum.torproject.org/t/security-release-0-4-8-25-and-0-4-9-8/21559 Changelog is below (same for both versions): Changes in version 0.4.9.8 - 2026-05-07 A quick second release because a silent error occurred in our CI build, which resulted in all fallback directories being removed from the list. This means that all new clients will bootstrap against the directory authorities. o Minor features (fallbackdir): - Regenerate fallback directories generated on May 07, 2026. Cheers! David -- G05XBgdQ1rTFTD4+6xzxND2USETuERE6bxDBnJH8wA0=

1 0

New Release: Tor Browser 15.0.12 (Android, Windows, macOS, Linux)
by Giorgio Maone 07 May '26

07 May '26

Hi everyone, Tor Browser 15.0.12 has now been published for all platforms. For details please see our blog post <https://blog.torproject.org/new-release-tor-browser-15012/>. * All Platforms o Updated tor to 0.4.9.7 o Bug tor-browser#44940 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44940>: Rebase Tor Browser stable onto 140.10.2esr * Windows + macOS + Linux o Updated Firefox to 140.10.2esr o Bug tor-browser#44746 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44746>: Funding the Commons Implementation (Desktop) * Android o Updated GeckoView to 140.10.2esr o Bug tor-browser#44747 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44747>: Funding the Commons Implementation (Android) * Build System o All Platforms + Bug tor-browser-build#41781 <https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/issues/4…>: Fix clean section in rbm.local.conf.example -- ma1

1 0

New Release: Tor Browser 16.0a6 (Android, Windows, macOS, Linux)
by Giorgio Maone 07 May '26

07 May '26

Hi everyone, Tor Browser 16.0a6 has now been published for all platforms. For details please see our blog post <https://blog.torproject.org/new-alpha-release-tor-browser-160a6/>. * All Platforms o Updated tor to 0.4.9.7 o Updated NoScript to 13.6.18.90101984 o Updated OpenSSL to 3.5.6 o Bug tor-browser#43857 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/43857>: Review in-source TODOs o Bug tor-browser#44402 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44402>: Re-enable ESLint rule mozilla/no-browser-refs-in-toolkit as an error o Bug tor-browser#44749 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44749>: Check search engines parameter replacements o Bug tor-browser#44792 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44792>: Rebase alpha onto 150.0a1 o Bug tor-browser#44796 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44796>: Adjust TorProviderBuilder to report the provider state to consumers o Bug tor-browser#44828 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44828>: Remove browser module references from toolkit/modules/ActorManagerParent.sys.mjs o Bug tor-browser#44841 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44841>: TorDomainIsolator proxy filter returns null on exception instead of preserving SOCKS proxy o Bug tor-browser#44865 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44865>: Block chrome:////locale// to content o Bug tor-browser#44868 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44868>: Backport 138c33ea964b2e0a4875aadc39d8a948e0c2aace to 150 to fix Windows builds o Bug tor-browser#44870 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44870>: Remove legacy branch from gitlab templates o Bug tor-browser#44895 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44895>: Undo the patch for #44772 o Bug tor-browser-build#41775 <https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/issues/4…>: Update list of Snowflake STUN servers in default bridge line, 2026 edition o Bug tor-browser-build#41778 <https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/issues/4…>: Remove base-browser from protected-branches.py o Bug tor-browser-build#41780 <https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/issues/4…>: Create sha256sums-unsigned-build.txt in artifacts/$platform directories * Windows + macOS + Linux o Updated Firefox to 150.0a1 o Bug tor-browser#43824 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/43824>: Switch resource:// modules to use moz-src: o Bug tor-browser#44288 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44288>: New identity fails to block loading a custom home page o Bug tor-browser#44458 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44458>: Fix the "Connect" and ".onion available" button height o Bug tor-browser#44560 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44560>: Customize the flags for alternate 'Application Data' directories o Bug tor-browser#44630 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44630>: Use settings config to hide settings, rather than data-hidden-from-search or commenting out o Bug tor-browser#44648 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44648>: Unexpected changes to SearchService.sys.mjs o Bug tor-browser#44685 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44685>: Use border radius for letterboxing o Bug tor-browser#44798 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44798>: Don't load |about:torconnect| into iframes o Bug tor-browser#44829 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44829>: Hide the settings privacy card o Bug tor-browser#44832 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44832>: Hide the Firefox mascot in about:neterror o Bug tor-browser#44846 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44846>: about:torconnect redirect doesn't work with the new neterror page o Bug tor-browser#44847 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44847>: Drop letterboxing sidebar rounded corner logic o Bug tor-browser#44902 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44902>: Error in privacy preference initialisation due to missing |dataCollectionViewProfilesMultiProfileBackupWarning| o Bug tor-browser-build#31860 <https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/issues/3…>: Start using LTO for firefox project * Windows o Bug tor-browser#44862 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44862>: Fontvis is missing Segoe MDL2 Assets o Bug tor-browser#44868 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44868>: Backport 138c33ea964b2e0a4875aadc39d8a948e0c2aace to 150 to fix Windows builds * macOS o Bug tor-browser#44850 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44850>: Wrong path for bootstrapped tor daemon on macOS o Bug tor-browser-build#41476 <https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/issues/4…>: Since 13.5-legacy is not longer supported, remove tools/signing/wrappers/sign-rcodesign * Linux o Bug tor-browser#44361 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44361>: Notify Linux i686 users that they won't receive updates anymore o Bug tor-browser#44521 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44521>: Disable widget.wayland.fractional-scale.enabled * Android o Updated GeckoView to 150.0a1 o Bug tor-browser#44615 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44615>: Remove ability to "Rate/Review in Google Play" in app o Bug tor-browser#44827 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44827>: Always enable noscript for android o Bug tor-browser#44842 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44842>: Replace instances of SwitchPreference with SwitchPreferenceCompat o Bug tor-browser#44848 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44848>: Do not overwrite Android toolchains on default mozconfigs o Bug tor-browser#44880 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44880>: Fix edgeToEdge display issue presented in 150 android rebase o Bug tor-browser#44925 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44925>: Fix bootstrap screen color styling for light mode presented in one of the rebases between 140 and 150 o Bug tor-browser#44935 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44935>: Remove incorrectly shown "open in app" notification dot on settings button * Build System o All Platforms + Bug tor-browser-build#41591 <https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/issues/4…>: Remove support for old mar filenames when 13.5 legacy branch is EOL + Bug tor-browser-build#41764 <https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/issues/4…>: Update toolchains for Firefox 150 + Bug tor-browser-build#41767 <https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/issues/4…>: Add jwilde to allowed signer for browser projects + Bug tor-browser-build#41778 <https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/issues/4…>: Remove base-browser from protected-branches.py + Bug tor-browser-build#41780 <https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/issues/4…>: Create sha256sums-unsigned-build.txt in artifacts/$platform directories + Bug tor-browser-build#41786 <https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/issues/4…>: Add comment to rbm.local.conf.example warning about potential recursive loops in tmp_dir definition + Bug rbm#40106 <https://gitlab.torproject.org/tpo/applications/rbm/-/issues/40106>: Improve error message in case of recursive definition o Windows + macOS + Linux + Bug tor-browser-build#41759 <https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/issues/4…>: Remove references to legacy release in tor-browser-build o Windows + Linux + Android + Bug tor-browser-build#41770 <https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/issues/4…>: Update Go to 1.26.x + Updated Go to 1.26.2 o Windows + Bug tor-browser#44853 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44853>: Update target in mozconfig-windows-x86_64 and mozconfig-windows-i686 o macOS + Bug tor-browser-build#41773 <https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/issues/4…>: Change the position of -mindepth when creating the dmg o Linux + Bug tor-browser#44555 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44555>: Remove mozconfig-linux-i686 o Android + Bug tor-browser#44848 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44848>: Do not overwrite Android toolchains on default mozconfigs -- ma1

1 0

[RELEASE] Tor stable 0.4.8.24 and 0.4.9.7
by David Goulet 07 May '26

07 May '26

Greetings, We released a security release of C-tor: 0.4.8.24 and 0.4.9.7. Announcement: https://forum.torproject.org/t/security-release-0-4-8-24-and-0-4-9-7/21551 Here is the ChangeLog (it is the same for both versions): Changes in version 0.4.8.24 - 2026-05-06 This is a security release fixing several major bugfixes that were reported in the past weeks. Huge thanks to everyone that reported these issues! We strongly recommend upgrading as soon as possible. o Major bugfixes (cell handling): - Fix out-of-bounds read (OOB) when END, TRUNCATE and TRUNCATED cell have no reason in their payload. TROVE-2026-011. Found by Brian Carpenter (geeknik). Fixes bug 41254; bugfix on 0.1.1.1-alpha. o Major bugfixes (conflux): - Do not attempt or accept BEGIN_DIR via conflux legs. TROVE-2026- 008. Credit to Anas Cherni from Calif.io in collaboration with Claude and Anthropic Research. Fixes bug 41243; bugfix on 0.4.8.1-alpha. o Major bugfixes (conflux, relay): - Adjust conflux out-of-order queue accounting when clearing a queue. TROVE-2026-010. Found by aptupdate. Fixes bug 41251; bugfix on 0.4.8.1-alpha. o Major bugfixes (pathbias): - Fix a client-side crash caused by double-close of a circuit while under circuit queue memory pressure. TROVE-2026-009. Found by cypherpunks. Fixes bug 41237; bugfix on 0.3.3.6-rc. o Major bugfixes (relay): - Fix null pointer dereference when receiving a CERT cell out of order. TROVE-2026-006. Found by Fwame. Fixes bug 41240; bugfix on 0.2.4.4-alpha. o Major bugfixes (relay, onion service): - Fix off-by-one out-of-bounds read if a malformed BEGIN cell is received. TROVE-2026-007. Found by Flanagan. Fixes bug 41245; bugfix on 0.2.4.7-alpha. o Minor features (fallbackdir): - Regenerate fallback directories generated on May 06, 2026. o Minor features (geoip data): - Update the geoip files to match the IPFire Location Database, as retrieved on 2026/05/06. Cheers! David -- CwtGMI5zvZfUUSzq+R0XWB1Y22UbVycqzHo0MCpl6X0=

1 0