- tor-announce - lists.torproject.org

New Release: Tor Browser 15.0.20 (Android, Windows, macOS, Linux)
by Giorgio Maone 18 Aug '26

18 Aug '26

Hi everyone, Tor Browser 15.0.20 has now been published for all platforms. For details please see our blog post <https://blog.torproject.org/new-release-tor-browser-15020/>. * All Platforms o Bug tor-browser#45204 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/45204>: Rebase Tor Browser stable onto 140.14.0esr o Bug tor-browser#45219 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/45219>: Backport Security Fixes from Firefox 154 * Windows + macOS + Linux o Updated Firefox to 140.14.0esr * Android o Updated GeckoView to 140.14.0esr * Build System o All Platforms + Bug tor-browser-build#41839 <https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/issues/4…>: Backport tor-browser-build-browser#41831: Update libevent to 2.1.13 + Bug tor-browser-build#41850 <https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/issues/4…>: Update keyring/torbrowser.gpg for new subkey and updated expiration date of the main key o Windows + Linux + Android + Updated Go to 1.25.13 -- ma1

1 0

Heads up: anti-censorship tools now packaged on deb.torproject.org
by Micah Anderson 30 Jul '26

30 Jul '26

Greetings, We're currently preparing 4 new Debian packages to be included in the Tor Project Debian repository hosted at "deb.torproject.org" in the coming days: * lyrebird * webtunnel * snowflake-proxy * snowflake-client If your system is configured with "deb.torproject.org" in your APT sources and any of the above packages are installed from the regular Debian archive, they will automatically upgrade the Tor Project-published versions. We're doing this to ensure that downstream users of these important anti-censorship tools have an update channel that allows them to receive timely upgrades automatically. That being said, packages from both channels should remain compatible and interchangeable. If you encounter any issues with them, please let us know by creating an issue in https://gitlab.torproject.org/tpo/anti-censorship/team/-/work_items. If you wish to add "deb.torproject.org" in your Debian system's APT sources, please follow the instructions at: https://support.torproject.org/little-t-tor/getting-started/installing/#deb… -- Micah Anderson (he/him) Director of Engineering The Tor Project, Inc. <https://torproject.org>

1 0

New Release: Tor Browser 16.0a9 (Android, Windows, macOS, Linux)
by Morgan 23 Jul '26

23 Jul '26

Hi everyone, Tor Browser 16.0a9 has now been published for all platforms. For details please see our blog post: - https://blog.torproject.org/new-alpha-release-tor-browser-160a9/ Changelog: > Tor Browser 16.0a9 - July 23 2026 > * All Platforms > * Updated NoScript to 13.6.30.90201984 > * Bug 43819: Show custom security level on android [tor-browser] > * Bug 44748: Revert Funding the Commons Implementations [tor-browser] > * Bug 44811: Remove the lock on pdfjs.disable. [tor-browser] > * Bug 45101: Rebase Tor Browser onto 153.0esr [tor-browser] > * Bug 45131: Security level is using an unsafe getBoolPref [tor-browser] > * Bug 41831: Update libevent to 2.1.13 [tor-browser-build] > * Windows + macOS + Linux > * Updated Firefox to 153.0esr > * Bug 44439: Remove translate action from urlbar [tor-browser] > * Bug 44883: Remove urlbar quick action for labs [tor-browser] > * Bug 45029: Convert connection status settings to new design and config approach [tor-browser] > * Bug 45055: Rename --color-gray-05 to --color-gray-0 [tor-browser] > * Bug 45081: Use the new "Acorn" icons on desktop [tor-browser] > * Bug 45110: Disable the settings redesign until ready for us [tor-browser] > * Bug 45112: Missing CSS border tokens in 153 [tor-browser] > * Bug 45132: nsAppFileLocationProvider.cpp: use of undeclared identifier 'XRE_EXECUTABLE_FILE' [tor-browser] > * Bug 41800: Create a script that adapts the Tor Browser manual HTMLs to work in Tor Browser [tor-browser-build] > * macOS > * Bug 45108: Artifact generation fails due to missing .DS_Store in the branding directories [tor-browser] > * Android > * Updated GeckoView to 153.0esr > * Bug 43820: Use SecurityLevel integration on android [tor-browser] > * Bug 44157: Remove secret setting toggle for Tab Management Redesign [tor-browser] > * Bug 45045: Remove moz asset in Downloads screen [tor-browser] > * Bug 45103: Disable broken "tab management" [tor-browser] > * Bug 45109: No value passed for parameter 'jsEnabled' [tor-browser] > * Bug 45118: Audit and disable Mozilla VPN promo [tor-browser] > * Bug 45130: Clean up TorHomePage padding [tor-browser] > * Build System > * All Platforms > * Bug 41838: Update personal_access_tokens URL in tools/fetch_changelogs.py [tor-browser-build] > * Windows + Linux + Android > * Updated Go to 1.26.5 > * Windows > * Bug 41819: Fix windows-rs URL in projects/firefox/config [tor-browser-build] best, -morgan

1 0

New Release: Tor Browser 15.0.19 (Android, Windows, macOS, Linux)
by Giorgio Maone 21 Jul '26

21 Jul '26

Hi everyone, Tor Browser 15.0.19 has now been published for all platforms. For details please see our blog post <https://blog.torproject.org/new-release-tor-browser-15019/>. * All Platforms o Updated NoScript to 13.6.31.1984 o Bug tor-browser#44748 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44748>: Revert Funding the Commons Implementations o Bug tor-browser#45117 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/45117>: Rebase Tor Browser stable onto 140.13.0esr o Bug tor-browser#45124 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/45124>: Backport Security Fixes from Firefox 153 * Windows + macOS + Linux o Updated Firefox to 140.13.0esr * Android o Updated GeckoView to 140.13.0esr * Build System o All Platforms + Bug tor-browser-build#41838 <https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/issues/4…>: Update personal_access_tokens URL in tools/fetch_changelogs.py o Windows + Bug tor-browser-build#41819 <https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/issues/4…>: Fix windows-rs URL in projects/firefox/config -- ma1

1 0

New Release: Tor Browser 15.0.18 (Android, Windows, macOS, Linux)
by Giorgio Maone 14 Jul '26

14 Jul '26

Hi everyone, Tor Browser 15.0.18 has now been published for all platforms. For details please see our blog post <https://blog.torproject.org/new-release-tor-browser-15018/>. * All Platforms o Updated NoScript to 13.6.30.1984 o Bug tor-browser#45111 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/45111>: Cherry-pick latest firefox/esr140 commits on 140.12.0esr * Build System o All Platforms + Bug tor-browser-build#41821 <https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/issues/4…>: Update gpg subkeys for boklm o Windows + Linux + Android + Updated Go to 1.25.12 -- ma1

1 0

New Release: Tor Browser 16.0a8 (Android, Windows, macOS, Linux)
by Giorgio Maone 02 Jul '26

02 Jul '26

Hi everyone, Tor Browser 16.0a8 has now been published for all platforms. For details please see our blog post <https://blog.torproject.org/new-alpha-release-tor-browser-160a8/>. * All Platforms o Updated NoScript to 13.6.25.90301984 o Updated Tor to 0.4.9.11 o Updated OpenSSL to 3.5.7 o Bug tor-browser#44857 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44857>: Drop |browser.display.use_system_colors| from our preference list o Bug tor-browser#44896 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44896>: Review Mozilla 2030929: Remove unused pref privacy.partition.network_state o Bug tor-browser#45018 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/45018>: resistfingerprinting not available in appearance.mjs in 152 o Bug tor-browser#45019 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/45019>: ReportBrokenSite startup error in 152 o Bug tor-browser#45047 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/45047>: Cross-site oracle via worklet rejection error in Safer Mode o Bug tor-browser#45072 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/45072>: Disable XSLT already for 16.0 * Windows + macOS + Linux o Updated Firefox to 152.0a1 o Bug tor-browser#44528 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44528>: Make sure desktop IP Protection is disabled on desktop o Bug tor-browser#44795 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44795>: Revert BB 27604 patch as not needed anymore o Bug tor-browser#44844 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44844>: Use new urlbar CSS variables o Bug tor-browser#44888 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44888>: Use |--button-opacity-disabled| for disabled styling. o Bug tor-browser#44955 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44955>: Use |context-fill| for |about-wordmark.svg| o Bug tor-browser#44956 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44956>: Switch colours in letterboxing setting icons to match the tab-alignment icons o Bug tor-browser#45016 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/45016>: Several errors about EngineProcess.sys.mjs in 152 o Bug tor-browser#45017 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/45017>: Wrong letterboxing background in 152 o Bug tor-browser#45037 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/45037>: Potential runtime errors in the search service when changing JS status o Bug tor-browser#45043 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/45043>: Re-add missing changes to settings after 151/152 rebase o Bug tor-browser#45083 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/45083>: Error in about:preferences due to ipprotection missing * macOS o Bug tor-browser#44728 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44728>: Bundled fonts are broken on macOS when the GPU process is enabled * Linux o Bug @ libfontconfig.so.1#45048 <https://gitlab.torproject.org/tpo/applications/@ libfontconfig.so.1/-/issues/45048>: Backport Bugzilla 2041887: Crash in after users upgraded to fontconfig 2.18.0 [tor-browser] * Android o Updated GeckoView to 152.0a1 o Bug tor-browser#43856 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/43856>: Fix onBackPressed() deprecation o Bug tor-browser#44091 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44091>: Add frequent regions to tor connection assist for android o Bug tor-browser#44175 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44175>: Remove all default browser functionality (Android) o Bug tor-browser#44769 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44769>: TBA crash screen has firefox asset as well as a "Send crash report" button o Bug tor-browser#45052 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/45052>: Initialise Tor modules on android in the same order as desktop * Build System o All Platforms + Bug tor-browser-build#41802 <https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/issues/4…>: Remove the tor daemon requirement for signing + Bug tor-browser-build#41809 <https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/issues/4…>: Update toolchains for Firefox 152 + Bug tor-browser-build#41813 <https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/issues/4…>: Disable build artifacts in |make generate_gradle_dependencies_list-geckoview| + Bug tor-browser-build#41821 <https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/issues/4…>: Update gpg subkeys for boklm + Bug tor-browser-build#41823 <https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/issues/4…>: Add versions information to the toolchain list update + Bug tor-browser-build#41827 <https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/issues/4…>: Update morgan's keychain with renewed key o Windows + Linux + Android + Updated Go to 1.26.4 o Windows + Bug tor-browser-build#41810 <https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/issues/4…>: Define GetAddrInfoExCancel on mingw o Android + Bug tor-browser#45086 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/45086>: Compress omni.ja with xz on Android + Bug tor-browser-build#41830 <https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/issues/4…>: Update the browser project to change omni.ja.xz -- ma1

1 0

New Release: Tor Browser 15.0.17 (Android, Windows, macOS, Linux)
by Giorgio Maone 29 Jun '26

29 Jun '26

Hi everyone, Tor Browser 15.0.17 has now been published for all platforms. For details please see our blog post <https://blog.torproject.org/new-release-tor-browser-15017/>. * All Platforms o Updated Tor to 0.4.9.11 o Updated NoScript to 13.6.25.1984 * Build System o All Platforms + Bug tor-browser-build#41821 <https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/issues/4…>: Update gpg subkeys for boklm + Bug tor-browser-build#41827 <https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/issues/4…>: Update morgan's keychain with renewed key -- ma1

1 0

[RELEASE] Security release - Tor stable version 0.4.9.11
by David Goulet 26 Jun '26

26 Jun '26

Greetings, We just released 0.4.9.11 as a security release. The announcement is here: https://forum.torproject.org/t/security-release-0-4-9-11/21786 As noted in the announcement, 0.4.9.10 went under the radar because we had to quickly plan for another release after and so we didn't do an official announcement for it until today. Here is the ChangeLog: Changes in version 0.4.9.11 - 2026-06-25 Security release follows in quick succession after the previous one due to additional high-priority security issues including one concerning onion services (#41297). We strongly recommend upgrading as soon as possible. o Major bugfixes (onion services): - Prevent a race condition where in just the right circumstances a rendezvous point could man-in-the-middle (impersonate) the onion service that the client was trying to reach. Fixes bug 41297; bugfix on 0.3.5.3-alpha. o Major bugfixes (client): - Clients no longer assert and exit if an onion service encodes an all-zero public key for one of its introduction points. Fixes bug 41295; bugfix on 0.3.2.1-alpha. o Major bugfixes (directory authorities): - Stop allowing 0 as a port in exit policy lines. We had put in some secondary checks to make sure exit policy ports weren't out of the expected range, but one of those checks accidentally allowed us to parse the port "0" as equivalent to the port range "1-0", which triggered an assert when generating a networkstatus vote (on v3 directory authorities) or a networkstatus document (on the bridge authority). Fixes bug 41292; bugfix on 0.1.2.5-alpha. o Major bugfixes (security, conflux): - Fix a use-after-free (and potential double free) of a conflux object when a recovery leg revives a conflux set whose last linked leg has already been closed. A malicious exit could use this to crash a client. TROVE-2026-026. Fixes bug 41306; bugfix on 0.4.8.1-alpha. o Minor features (fallbackdir): - Regenerate fallback directories generated on June 25, 2026. o Minor features (geoip data): - Update the geoip files to match the IPFire Location Database, as retrieved on 2026/06/25. Changes in version 0.4.9.10 - 2026-06-23 Another release with an important security fix and major bugfixes. We strongly recommend upgrading as soon as possible. o Major bugfixes (conflux, security, TROVE): - Reject a CONFLUX_LINK cell that arrives on a circuit which already has attached streams. A malicious client could send a RELAY_COMMAND_BEGIN before the CONFLUX_LINK on the same circuit, attaching an exit stream that would later end up orphan leaving a dangling circuit back-pointer and a use-after-free (UAF) when the circuit is freed. TROVE-2026-025. Fixes bug 41258; bugfix on 0.4.8.1-alpha. o Major bugfixes (client): - Resume warning about unsafe socks protocols (socks4 or socks5-not-hostname) when SafeSocks is not set. Also resume warning every time when TestSocks is set. Fixes bug 41290; bugfix on 0.2.2.18-alpha and 0.2.4.11-alpha. o Major bugfixes (clients): - Make clients more consistently expire entry guards 48 to 60 days after they are first used. Previously, we would sometimes expire entry guards after this intended range, but sometimes we would wait up to 120 days. Fixes bug 41280; bugfix on 0.3.0.1-alpha. o Minor features (fallbackdir): - Regenerate fallback directories generated on June 23, 2026. o Minor features (geoip data): - Update the geoip files to match the IPFire Location Database, as retrieved on 2026/06/23. o Minor bugfixes (code security): - Add a defensive check in port_parse_ports_relay() to make it clearer to static analysis tools that there is no security problem. Fixes bug 41278; bugfix on 0.4.3.1-alpha. o Minor bugfixes (client-side onion service): - Stop leaking memory in the case where the client fetches a well- formed onion descriptor but it turns out to not match the onion address we intended to fetch. Fixes bug 41264; bugfix on 0.3.2.1-alpha. o Minor bugfixes (directory authorities): - Correctly omit "package" lines from the consensus. In proposal 301 we tried to make a new consensus method that never generates "package" lines, but we got the logic wrong. Fixes bug 41293; bugfix on 0.4.9.1-alpha. o Minor bugfixes (relay): - Avoid a mistaken BUG() warning and backtrace if a client sends an INTRODUCE1 cell using the legacy format from v2 onion services. This error case was already handled correctly, but there's no need to warn and backtrace. Fixes bug 41299; bugfix on 0.4.6.1-alpha. Cheers! David -- cRaZH0sx1J1BKO2hWyJsGpi/KvY3GEdhNCKTK09Sl4A=zz

1 0

New Release: Tor Browser 15.0.16 (Android, Windows, macOS, Linux)
by Nicolas Vigier 17 Jun '26

17 Jun '26

Hi everyone, Tor Browser 15.0.16 has now been published for all platforms. For details please see our blog post: https://blog.torproject.org/new-release-tor-browser-15016/ Changelog: * All Platforms * Updated NoScript to 13.6.24.1984 * Updated OpenSSL to 3.5.7 * Bug 45044: NS 13.6.19.902 DocStartInjection regressed [tor-browser] * Bug 45046: Rebase Tor Browser stable onto 140.12.0esr [tor-browser] * Bug 45054: Backport Security Fixes from Firefox 152 [tor-browser] * Windows + macOS + Linux * Updated Firefox to 140.12.0esr * Android * Updated GeckoView to 140.12.0esr * Build System * All Platforms * Bug 41802: Remove the tor daemon requirement for signing [tor-browser-build] * Windows + Linux + Android * Updated Go to 1.25.11

1 0

New Release: Tor Browser 16.0a7 (Android, Windows, macOS, Linux)
by Giorgio Maone 04 Jun '26

04 Jun '26

Hi everyone, Tor Browser 16.0a7 has now been published for all platforms. For details please see our blog post <https://blog.torproject.org/new-alpha-release-tor-browser-160a7/>. * All Platforms o Updated NoScript to 13.6.19.90401984 o Updated Tor to 0.4.9.9 o Bug tor-browser#42436 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/42436>: Allow for multiple configured (front, reflector) domain fronting pairs in Moat module o Bug tor-browser#44869 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44869>: Rebase alpha onto 151 o Bug tor-browser#44952 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44952>: TOR_PROVIDER=none throws an error at launch o Bug tor-browser#44989 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44989>: Backport Bug 2040704: Fix date format leak in Firefox 151 o Bug tor-browser#44990 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44990>: CI failing due to dubious ownership of cached repo o Bug tor-browser#44999 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44999>: Privacy settings are broken in 151 o Bug tor-browser-build#41686 <https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/issues/4…>: Copy more build artifacts to the artifacts directory * Windows + macOS + Linux o Updated Firefox to 151.0a1 o Bug tor-browser#44903 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44903>: Use the |support-page| instead of |tor-manual-page| in |moz-support-link| o Bug tor-browser#44904 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44904>: Use settings config for onion site settings o Bug tor-browser#44991 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44991>: Improve the no-authentication handling on the control port o Bug tor-browser#44997 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44997>: Captcha doesn't work in TB desktop o Bug tor-browser#45005 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/45005>: Rename arrowpanel CSS variable * Windows o Bug tor-browser#44745 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44745>: Change how we hide SSO setting for windows * Android o Updated GeckoView to 151.0a1 o Bug tor-browser#43543 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/43543>: Make the dev icon distinct from the nightly one o Bug tor-browser#44211 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44211>: Disable "Shake it up. Skip the scroll." o Bug tor-browser#44323 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44323>: Audit Android Settings changes from 128 to 140 o Bug tor-browser#44917 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/44917>: Disable Ads client for all channels o Bug tor-browser#45031 <https://gitlab.torproject.org/tpo/applications/tor-browser/-/issues/45031>: Disable AI features for Android * Build System o All Platforms + Bug tor-browser-build#41779 <https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/issues/4…>: Update toolchains for Firefox 151 + Bug tor-browser-build#41781 <https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/issues/4…>: Fix clean section in rbm.local.conf.example + Bug tor-browser-build#41792 <https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/issues/4…>: Switch from ftp.gnu.org to ftpmirror.gnu.org + Bug tor-browser-build#41798 <https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/issues/4…>: Update the URL to versions.ini in relprep.py + Bug tor-browser-build#41806 <https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/issues/4…>: |make list_toolchain_updates| should check var/firefox_platform_version + Bug tor-browser-build#41807 <https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/issues/4…>: Incorrectly generated Bugzilla query link in generate-bugzilla-triage-csv.py o Windows + Linux + Android + Updated Go to 1.26.3 o macOS + Bug tor-browser-build#41793 <https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/issues/4…>: Stop copying permissions from .mar in dmg2mar o Android + Bug tor-browser-build#41801 <https://gitlab.torproject.org/tpo/applications/tor-browser-build/-/issues/4…>: Hardlink artifacts in fix_gradle_deps.py -- ma1

1 0