Tor Updates & Release Notes

Tor Browser 16.0a11 is now available from the Tor Browser download page and also from our distribution directory.

This version includes important security updates to Firefox.

⚠️ Reminder: The Tor Browser Alpha release-channel is for testing only. As such, Tor Browser Alpha is not intended for general use because it is more likely to include bugs affecting usability, security, and privacy.

If you are an at-risk user, require strong anonymity, or just want a reliably-working browser, please stick with the stable release channel.

Send us your feedback

If you find a bug or have a suggestion for how we could improve this release, please let us know.

Full changelog

The full changelog since Tor Browser 16.0a10 is:

• All Platforms
  • Bug tor-browser#45254: Rebase Tor Browser alpha onto 153.2.0esr
  • Bug tor-browser#45259: Backport Security Fixes from Firefox 155
• Windows + macOS + Linux
  • Updated Firefox to 153.2.0esr
  • Bug tor-browser#45264: Use parent process for TorConnect redirections
• Android
  • Updated GeckoView to 153.2.0esr
  • Bug tor-browser#44155: Always enable LNA on Android as a defense-in-depth
• Build System
  • All Platforms
    • Bug tor-browser-build#41860: Change GCC sources mirror to https://gcc.gnu.org
  • Windows + Linux + Android
    • Updated Go to 1.26.8

Original source

Tor Browser 15.0.21 is now available from the Tor Browser download page and also from our distribution directory.
This version includes important security updates to Firefox.

Send us your feedback

If you find a bug or have a suggestion for how we could improve this release, please let us know.

Full changelog

The full changelog since Tor Browser 15.0.20 is:

• All Platforms
  • Updated NoScript to 13.6.32.1984
  • Updated OpenSSL to 3.5.8
  • Bug tor-browser#45223: Backport tor-browser#45220 - about:torconnect doesn't show when launching the browser in non-PBM
  • Bug tor-browser#45253: Rebase Tor Browser stable onto 140.15.0esr
  • Bug tor-browser#45259: Backport Security Fixes from Firefox 155
• Windows + macOS + Linux
  • Updated Firefox to 140.15.0esr
  • Bug tor-browser#44996: Change the 32-bit linux message to the expired version for the final 15.0 release
  • Bug tor-browser#45264: Use parent process for TorConnect redirections
• Android
  • Updated GeckoView to 140.15.0esr
• Build System
  • Windows + Linux + Android
    • Updated Go to 1.25.14

Original source

Tor Browser 16.0a10 is now available from the Tor Browser download page and also from our distribution directory.

This version includes important security updates to Firefox.

⚠️ Reminder: The Tor Browser Alpha release-channel is for testing only. As such, Tor Browser Alpha is not intended for general use because it is more likely to include bugs affecting usability, security, and privacy.

Moreover, Tor Browser Alphas are now based on Firefox's betas. Please read more about this important change in the Future of Tor Browser Alpha blog post.

If you are an at-risk user, require strong anonymity, or just want a reliably-working browser, please stick with the stable release channel.

✨ New Features which need attention!

📖 Updated Built-in manual on Desktop Tor Browser

The Tor Project's old support page and content has been updated. Starting with Tor Browser 16.0a10, this updated design and content is now baked into the browser and replaces the legacy manual. You can access the manual directly by navigating to about:manual in the URL bar or by clicking on the various "Learn more" links found in the browser's UI.

⚙️ Settings Redesign now enabled by default

With Tor Browser 16.0a10, we have enabled the new about:preferences designs from Mozilla by default. Our additional settings (connectivity, letterboxing, security level, etc) should now all be migrated over and using the new design language. Please file an issue if you find any regressions!

🪟 Generic Window Titles

On most (all?) desktop operating systems, applications have the ability to programmatically set and update the title of their windows. Normally, this is very useful as it allows the names of your applications to appear in the desktop UI in the title bar or as entries in application switchers (e.g. when you alt-tab between applications).

Historically, web browsers have dynamically updated their application's window title to the contents of the current web page's <title> element. For example, the window name for the browser window you are currently using is very likely some variant of New Alpha Release: Tor Browser 16.0a10 | The Tor Project — Tor Browser. If you were to navigate away from this page (please don't), the title would be updated to some variant of that page's <title> element contents.

While this process provides convenient usability to end-users, these title changes are generally detectable and readable by 3rd party applications or the operating system itself. This is typically not a privileged action, meaning software does not typically require special permissions to do this. These same APIs which allow programs to enumerate open windows also allow them to record browsing history using window title changes as a side-channel.

To counteract this, we've developed (and upstreamed) an opt-in feature disabling these window title changes and instead replacing them with just the the name of the browser. You can try this feature out by going to about:preferences, clicking on Privacy and security in the navigation panel, clicking on Advanced settings within the Connection and software security group, and checking Use generic window titles in the Protections from third-party applications group. With this setting enabled, all Tor Browser window titles should now simply read Tor Browser Alpha.

For any vanilla Firefox users out there, you can enable this feature by going to about:config and setting the privacy.exposeContentTitleInWindow (for normal-browsing windows) and privacy.exposeContentTitleInWindow.pbm (for private-browsing windows) boolean options to false.

We had hoped to enable this feature by default in the 16.0 series, but it is a bit late in the release cycle to push out such a feature with potentially unseen side-effects (e.g. causing breakage with a11y software, specific desktop environments, or other custom configurations) without user testing. Please give this feature a go (especially if your desktop environment is non-standard) and report back any issues or incompatibilities you find.

Send us your feedback

If you find a bug or have a suggestion for how we could improve this release, please let us know.

Full changelog

The full changelog since Tor Browser 16.0a9 is:

• All Platforms

  • Updated NoScript to 13.6.31.90301984
  • Updated OpenSSL to 3.5.8
  • Bug tor-browser#44257 : Disable locale-based font rules as a defense-in-depth
  • Bug tor-browser#45161 : Drop TorProviderBuilder.firstWindowLoaded
  • Bug tor-browser#45205 : Rebase Tor Browser onto 153.1.0esr
  • Bug tor-browser#45219 : Backport Security Fixes from Firefox 154

• Windows + macOS + Linux

  • Updated Firefox to 153.1.0esr
  • Bug tor-browser#43570 : Report errors in about:torconnect when tor daemon crashes (Desktop)
  • Bug tor-browser#43640 : Poor screen reader experience when opening preferences and scrolling to element
  • Bug tor-browser#43939 : Update Bridge settings when connection failed
  • Bug tor-browser#44247 : Adapt Tor Browser manual to use the new support pages
  • Bug tor-browser#44511 : Make sure new search suggest features are disabled for 16.0
  • Bug tor-browser#44629 : Add a search suggestion warning in the settings
  • Bug tor-browser#44699 : Amend commit message for "BB 43322: Customize the font visibility lists"
  • Bug tor-browser#44802 : Hide the "safe browsing" settings
  • Bug tor-browser#44830 : Migrate our home page adjustments to the settings config
  • Bug tor-browser#44831 : Misleading banner in "Search engine suggestions" settings
  • Bug tor-browser#44855 : Use ariaNotify for bridge updates
  • Bug tor-browser#44959 : Integrate the new Tor Browser manual into Tor Browser
  • Bug tor-browser#44998 : Remove Firefox branding from about:preferences
  • Bug tor-browser#45039 : Make it easier to test ProfileDataUpgrader customization
  • Bug tor-browser#45051 : Show a separate Tor error prompt for users who do not see about:torconnect (desktop)
  • Bug tor-browser#45058 : Convert bridge settings to new design and config approach
  • Bug tor-browser#45059 : Convert advanced connection settings to new design and config approach
  • Bug tor-browser#45079 : Move letterboxing to the appearance setting pane
  • Bug tor-browser#45123 : Disable profile backup for 16.0
  • Bug tor-browser#45125 : Tidy up bridge emoji widget
  • Bug tor-browser#45143 : Modify moz-fieldset to allow focusing the heading
  • Bug tor-browser#45156 : Remove "Firefox Home" from the appearance settings
  • Bug tor-browser#45157 : Grant "access local files" permission to NoScript (Firefox 153 and above)
  • Bug tor-browser#45168 : Hide the history search option, again
  • Bug tor-browser#45169 : Cannot open history sidebar in private browsing window
  • Bug tor-browser#45171 : Disable split view for 16.0
  • Bug tor-browser#45176 : Add "Request English" to the website language config
  • Bug tor-browser#45178 : Change support URLs in new settings
  • Bug tor-browser#45179 : Update the feedback URL to point to the new support page.
  • Bug tor-browser#45180 : Also show download warning in download settings
  • Bug tor-browser#45185 : Disable network also in the Rust implementation of the remote settings client
  • Bug tor-browser#45186 : Remove duplicate alert roles in moz-message-bar
  • Bug tor-browser#45187 : Disable private browsing "delete downloaded files" feature
  • Bug tor-browser#45190 : New circuit urlbar icon button is squished
  • Bug tor-browser#45192 : Some URLs trigger The proxy server is refusing connections rather than about:torconnect prior to bootstrap
  • Bug tor-browser#45194 : "Your bridges" background color
  • Bug tor-browser#45195 : Modify our calls to openPreferences to work with the new settings
  • Bug tor-browser#45196 : Replace old connection settings with setting-group widgets
  • Bug tor-browser#45197 : Hide password settings by default
  • Bug tor-browser#45200 : Include onion authentication in the new password settings
  • Bug tor-browser#45201 : Convert security level settings to the new config
  • Bug tor-browser#45208 : Switch on the setting redesign
  • Bug tor-browser#45209 : Remove mention of "sync" from new settings
  • Bug tor-browser#45211 : Add settings for protections from third party applications
  • Bug tor-browser#45214 : Keep megalist (contextual password manager) disabled for 16.0
  • Bug tor-browser#45220 : about:torconnect doesn't show when launching the browser in non-PBM
  • Bug tor-browser#45226 : Stylelint issues on browser/components/torpreferences/content/torPreferences.css
  • Bug tor-browser#45228 : Drop browser.urlbar.update2.engineAliasRefresh
  • Bug tor-browser#45232 : Spoof picture-in-picture sizes under RFP
  • Bug tor-browser#45236 : Resolve miscellaneus accessibility issues in about:torconnect
  • Bug tor-browser#45245 : Fix a ML file inclusion that creates an error

• Windows + Android

  • Bug tor-browser#44513 : Backport Bugzilla 2059471: Do not spoof screen orientation when it is locked

• Windows

  • Bug tor-browser#45144 : Do not offer to make the browser a PDF viewer when in portable mode
  • Bug tor-browser#45243 : Disable taskbar tabs

• macOS

  • Bug tor-browser#45163 : Consistently do not disable app group container support

• Android

  • Updated GeckoView to 153.1.0esr
  • Bug tor-browser#41758 : Don't allow PDFs to be opened by 3rd party apps
  • Bug tor-browser#43571 : Implement improved error handling and tor restart flow (Android)
  • Bug Download v2#44054 : Review Mozilla 1970806: Implement new UI for External Download Manager dialog [tor-browser]
  • Bug tor-browser#44210 : Consider dropping shouldDisableNormalMode setting
  • Bug 44448: Trivialise assets rather than delete them in "[android] Delete unused media" [tor-browser]
  • Bug tor-browser#44758 : Disable email mask feature
  • Bug tor-browser#44881 : Remove link sharing setting on android
  • Bug tor-browser#44921 : Disable Google Lens feature
  • Bug tor-browser#45049 : Opening a pdf from outside TBA crashes TBA after bootstrapping it not already bootstrapped
  • Bug tor-browser#45085 : Disable GooglePlay Integrity
  • Bug tor-browser#45098 : Share link button shows in landscape mode on android despite being removed elsewhere
  • Bug tor-browser#45115 : Padlock always shows insecure even for HTTPS and Onion sites
  • Bug tor-browser#45159 : Fix Android Padlock security pane colors
  • Bug tor-browser#45170 : Tab Switcher shows Firefox's private browsing mask badge on tab switcher icon
  • Bug tor-browser#45173 : Disable Search Optimizations for android
  • Bug android#45203 : Rebase error with: TB 40041: Implement Tor Network Settings [tor-browser]
  • Bug tor-browser#45221 : Remove "Manage downloads with another app" setting from TBA download settings
  • Bug tor-browser#45227 : Remove "Default search engine for Standard Mode"
  • Bug tor-browser#45234 : Do not spoof secondary screen orientations if they were requested by a lock

• Build System

  • All Platforms

    • Bug tor-browser#45224 : Enable Rust linter in CI
    • Bug tor-browser#45231 : Backport Bugzilla 2053518: Rust target detection fails to translate the host triple with rustc nightly >= 2026-07-02 (new -oe-linux- targets)
    • Bug tor-browser-build#41844 : Add scripts to backup/deploy signing keys on signing machines
    • Bug tor-browser-build#41850 : Update keyring/torbrowser.gpg for new subkey and updated expiration date of the main key

  • Windows + macOS + Linux

    • Bug tor-browser-build#41711 : Update our manual machinery for its new home

  • Windows + Linux + Android

    • Updated Go to 1.26.7

  • Android

    • Bug tor-browser-build#41843 : Remove unused universal apk from geckoview

Original source

Tor Browser 15.0.20 is now available from the Tor Browser download page and also from our distribution directory.

This version includes important security updates to Firefox.

Send us your feedback

If you find a bug or have a suggestion for how we could improve this release, please let us know.

Full changelog

The full changelog since Tor Browser 15.0.19 is:

• All Platforms
  • Bug tor-browser#45204: Rebase Tor Browser stable onto 140.14.0esr
  • Bug tor-browser#45219: Backport Security Fixes from Firefox 154
• Windows + macOS + Linux
  • Updated Firefox to 140.14.0esr
• Android
  • Updated GeckoView to 140.14.0esr
• Build System
  • All Platforms
    • Bug tor-browser-build#41839: Backport tor-browser-build-browser#41831: Update libevent to 2.1.13
    • Bug tor-browser-build#41850: Update keyring/torbrowser.gpg for new subkey and updated expiration date of the main key
  • Windows + Linux + Android
    • Updated Go to 1.25.13

Original source

Tor Browser 16.0a9 is now available from the Tor Browser download page and also from our distribution directory.

This version includes important security updates to Firefox.

⚠️ Reminder: The Tor Browser Alpha release-channel is for testing only. As such, Tor Browser Alpha is not intended for general use because it is more likely to include bugs affecting usability, security, and privacy.

Moreover, Tor Browser Alphas are now based on Firefox's betas. Please read more about this important change in the Future of Tor Browser Alpha blog post.

If you are an at-risk user, require strong anonymity, or just want a reliably-working browser, please stick with the stable release channel.

It's ESR transition season again!

Well actually, it has been ESR transition season throughout this entire release cycle! As described in the aforementioned Future of Tor Browser Alpha blog post, we have been incrementally rebasing our Alpha channel on Firefox betas since December of last year. As a result, we now stand before you with Tor Browser 16.0a9 which is based on Firefox ESR 153.

We will continue rebasing Tor Browser 17.0 Alpha branches on Firefox betas throughout the remainder of the Tor Browser 16.0 release cycle. However, new feature-work for now must be put on hold for a few reasons:

• We must focus our attention on resolving our Bugzilla Audit issues to ensure the features we have inherited from upstream comply Tor Browser's threat model and to patch any changes which do not.
• Feature work targeting 16.0 stable would need to be cherry-pick'd onto our 17.0 Alpha branches to ensure we don't lose any work. The more invasive a feature patch is, the harder it will be to port to newer versions. This would also be a potentially error-prone process and there is some risk we would lose patches along the way.
• We need to finish stabilizing as soon as possible as we have hard external deadlines which cannot be moved: the end-of-life of Firefox ESR 140 on October 13th and the Google Play Minimum Target API Level requirement on November 1st

Challenges and Triumphs

💍 Sharing the Load

Rebasing the hundreds of Tor Browser patches onto newer versions of Firefox is a challenging task. It is like maintaining the structural stability of sand-castle at high-tide with the waves crashing all around you.

As such, it quickly become clear early in this new process that we would need to do something if we wanted to avoid burning out the few developers typically involved in this work. To mitigate this, we shared the knowledge internally and spread the work out across all eight members of the team. This way, each developer was only responsible for at most two or three rebases throughout the entire release cycle.

🎨 UI Code Churn

Over the past year, Firefox has developed and integrated two major changes to the UI in Firefox: a redesign of about:preferences in Firefox Desktop and a migration from Material 2 to Material 3 in Firefox Android.

Adapting to these types of changes to the frontend are typically rather time-consuming for us, as many (if not the majority) of our patches modify Firefox's UI in some way. For example, we have an entire preferences page on Tor Browser desktop dedicated to configuring how the browser connects to the Tor Network. On Android, we similarly have various additions to the menus, configuration options, and custom UI.

Whenever Mozilla modifies their design systems and Firefox's user interface, we necessarily have to adapt our own custom additions to match. Otherwise, our Tor Browser-specific UI elements would look completely out of place and potentially confuse users (as well as simply looking unprofessional). Therefore, each of these upstream changes requires collaboration with the Tor Project's UX team to update our features' designs and of course development time to implement.

In addition to the time-cost associated with the extra engineering and UX collaboration, very often our old patches simply do not apply cleanly due to the amount of code which has changed. For example, the about:preferences changes on Firefox Desktop are essentially a complete re-write which means we also have to completely re-write our own settings changes without regressing in functionality.

On the plus side, one benefit of our new processes is that we have been able to spread out this work over the entire release cycle. In the past way of doing things, we would have discovered all UX elements which needed to be fixed, updated our designs, and re-implemented in the course of a few months during the old ESR transition season. Under this new way of working, we have been able to incrementally fix things throughout the development cycle.

The benefits of working this way does not just apply to UX of course. It is much easier to find regressions across the entire stack when rebasing between one major Firefox version at a time instead of across 12 or 13. It is also much easier for developers to fix individual regressions one at a time compared to diagnosing, disentangling, and fixing multiple bugs concurrently (divide et impera!).

⚙️ Pending Google Target API Level Requirements

Every year, Google requires new Android app releases to target an updated minimum API level. This means, we would not be able to upload new versions of Tor Browser Stable past a certain date (usually August 1st with an extension to November 1st typically possible) without first updating the app to support the new minimum target API level. Fortunately, we inherit most of the required changes from Mozilla when rebasing to the next major ESR.

However, this requirement does impose a hard deadline for the absolute latest we can responsibly stabilize Tor Browser Alpha and promote it to Stable. We've been fortunate in the past few years to make the deadline with a few days to spare (October 28th for Tor Browser 15, October 22nd for Tor Browser 14, etc). Given how far ahead of the curve we are this year, we are hoping to release about a month earlier in September (fingers crossed!).

🤖 Android APKs too big

The Google Play Store has a strict size limit of about 100 megabytes for Android applications. New functionality added to Firefox Android over the past year means a larger application which results in new headaches for Tor Browser developers. This release cycle was no exception to this rule and we have had to get creative with our size reductions.

In the past, we have been able reduce our package size though various methods including:

• Using custom size-reducing compiler flags
• Compiling multiple pluggable-transports into a single unified binary to de-duplicate shared dependencies
• Removing unused Firefox assets from the build
• Replacing unused (but still linked) libraries with no-op stubs
• and countless other methods over there years

Our most recent effort has been the most invasive yet! For some background, the Firefox application consists of (among other things): various shared libraries, the Firefox executable, a library known as 'xul' which contains most of Firefox's natively compiled functionality, and finally a file known as omni.ja. This omni.ja file is a zip archive which contains the JavaScript, HTML, images, and other assets used in Firefox.

This time around, to reduce the size of our Android package we have changed how this archive is compressed. We modified the Firefox build system to compress this archive with xz and we modified Firefox itself to decompress this archive at runtime. This work did require a few iterations to get right. In the end, we got back about 3 megabytes with these changes and got us once again under Google's imposed size budget.

📉 Even Less Telemetry

Over the years, we have worked to incrementally remove dependencies from Tor Browser Android as part of the aforementioned size reduction work. We of course inherit most of these dependencies from Firefox Android and unfortunately some of them can be labeled as 'trackers'. While we do disable telemetry by default at runtime, the code which implements it remains in the codebase.

We're happy to report that as of Tor Browser 16.0a8, are down to only 1 'tracker' library in the Tor Browser Android codebase: Mozilla Telemetry. Again, this telemetry is disabled at runtime, but this is one more unused dependency which we can hopefully remove in the future (and maybe get some more bytes back!).

Current Status

We have:

• incrementally rebased Tor Browser and Tor Browser for Android to Firefox ESR 153 from Firefox ESR 140
• updated the build systems with the latest dependencies and fixed a few reproducibility issues
• triaged most of the upstream changes from the past year and flagged over 250 issues for further review (triaging of Firefox 153 is in progress)
• resolved about half of these triaged issues

For the remainder of this release cycle, we will be focusing on auditing these issues and fixing bugs until the 16.0 alpha series is ready to become Tor Browser Stable 16.0. We are optimistically targeting a September release, which would put us one month ahead of schedule compared to last year.

Known Issues

🦊 Firefox Branding

In some places in the browser there may be Firefox branding (e.g. logos, cute little foxes, etc) instead of Tor Browser branding. We're currently tracking one known instance in tor-browser#44998. If you discover any other instances lurking about, please open an issue!

🌐 All websites marked 'insecure' on Tor Browser Android

Currently, the identity block in the URL bar on Tor Browser Android will always report insecure (e.g. a shield icon with a slash through it). For now, you can tap this icon and verify the certificate manually. This issue is being tracked in tor-browser#45115.

Send us your feedback

Now is a great time to become an alpha tester! If you find a bug or have a suggestion for how we could improve this release, please let us know.

Full changelog

The full changelog since Tor Browser 16.0a8 is:

• All Platforms
  • Updated NoScript to 13.6.30.90201984
  • Bug tor-browser#43819: Show custom security level on android
  • Bug tor-browser#44748: Revert Funding the Commons Implementations
  • Bug tor-browser#44811: Remove the lock on pdfjs.disable.
  • Bug tor-browser#45101: Rebase Tor Browser onto 153.0esr
  • Bug tor-browser#45131: Security level is using an unsafe getBoolPref
  • Bug tor-browser-build#41831: Update libevent to 2.1.13
• Windows + macOS + Linux
  • Updated Firefox to 153.0esr
  • Bug tor-browser#44439: Remove translate action from urlbar
  • Bug tor-browser#44883: Remove urlbar quick action for labs
  • Bug tor-browser#45029: Convert connection status settings to new design and config approach
  • Bug tor-browser#45055: Rename --color-gray-05 to --color-gray-0
  • Bug tor-browser#45081: Use the new "Acorn" icons on desktop
  • Bug tor-browser#45110: Disable the settings redesign until ready for us
  • Bug tor-browser#45112: Missing CSS border tokens in 153
  • Bug tor-browser#45132: nsAppFileLocationProvider.cpp: use of undeclared identifier 'XRE_EXECUTABLE_FILE'
  • Bug tor-browser-build#41800: Create a script that adapts the Tor Browser manual HTMLs to work in Tor Browser
• macOS
  • Bug tor-browser#45108: Artifact generation fails due to missing .DS_Store in the branding directories
• Android
  • Updated GeckoView to 153.0esr
  • Bug tor-browser#43820: Use SecurityLevel integration on android
  • Bug tor-browser#44157: Remove secret setting toggle for Tab Management Redesign
  • Bug tor-browser#45045: Remove moz asset in Downloads screen
  • Bug tor-browser#45103: Disable broken "tab management"
  • Bug tor-browser#45109: No value passed for parameter 'jsEnabled'
  • Bug tor-browser#45118: Audit and disable Mozilla VPN promo
  • Bug tor-browser#45130: Clean up TorHomePage padding
• Build System
  • All Platforms
    • Bug tor-browser-build#41838: Update personal_access_tokens URL in tools/fetch_changelogs.py
  • Windows + Linux + Android
    • Updated Go to 1.26.5
  • Windows
    • Bug tor-browser-build#41819: Fix windows-rs URL in projects/firefox/config

Original source

Tor Browser 15.0.19 is now available from the Tor Browser download page and also from our distribution directory.

This version includes important security updates to Firefox.

Send us your feedback

If you find a bug or have a suggestion for how we could improve this release, please let us know.

Full changelog

The full changelog since Tor Browser 15.0.18 is:

• All Platforms
  • Updated NoScript to 13.6.31.1984
  • Bug tor-browser#44748: Revert Funding the Commons Implementations
  • Bug tor-browser#45117: Rebase Tor Browser stable onto 140.13.0esr
  • Bug tor-browser#45124: Backport Security Fixes from Firefox 153
• Windows + macOS + Linux
  • Updated Firefox to 140.13.0esr
• Android
  • Updated GeckoView to 140.13.0esr
• Build System
  • All Platforms
    • Bug tor-browser-build#41838: Update personal_access_tokens URL in tools/fetch_changelogs.py
  • Windows
    • Bug tor-browser-build#41819: Fix windows-rs URL in projects/firefox/config

Original source

Tor Browser 15.0.18 is now available from the Tor Browser download page and also from our distribution directory.

This version includes important security updates to Firefox.

Send us your feedback

If you find a bug or have a suggestion for how we could improve this release, please let us know.

Full changelog

The full changelog since Tor Browser 15.0.17 is:

• All Platforms
  • Updated NoScript to 13.6.30.1984
  • Bug tor-browser#45111: Cherry-pick latest firefox/esr140 commits on 140.12.0esr
• Build System
  • All Platforms
    • Bug tor-browser-build#41821: Update gpg subkeys for boklm
  • Windows + Linux + Android
    • Updated Go to 1.25.12

Original source

Tor Browser 16.0a8 is now available from the Tor Browser download page and also from our distribution directory.

This version includes important security updates to Firefox.

⚠️ Reminder: The Tor Browser Alpha release-channel is for testing only. As such, Tor Browser Alpha is not intended for general use because it is more likely to include bugs affecting usability, security, and privacy.

Moreover, Tor Browser Alphas are now based on Firefox's betas. Please read more about this important change in the Future of Tor Browser Alpha blog post.

If you are an at-risk user, require strong anonymity, or just want a reliably-working browser, please stick with the stable release channel.

Send us your feedback

If you find a bug or have a suggestion for how we could improve this release, please let us know.

Full changelog

The full changelog since Tor Browser 16.0a7 is:

All Platforms

• Updated NoScript to 13.6.25.90301984
• Updated Tor to 0.4.9.11
• Updated OpenSSL to 3.5.7
• Bug tor-browser#44857: Drop browser.display.use_system_colors from our preference list
• Bug tor-browser#44896: Review Mozilla 2030929: Remove unused pref privacy.partition.network_state
• Bug tor-browser#45018: resistfingerprinting not available in appearance.mjs in 152
• Bug tor-browser#45019: ReportBrokenSite startup error in 152
• Bug tor-browser#45047: Cross-site oracle via worklet rejection error in Safer Mode
• Bug tor-browser#45072: Disable XSLT already for 16.0

Windows + macOS + Linux

• Updated Firefox to 152.0a1
• Bug tor-browser#44528: Make sure desktop IP Protection is disabled on desktop
• Bug tor-browser#44795: Revert BB 27604 patch as not needed anymore
• Bug tor-browser#44844: Use new urlbar CSS variables
• Bug tor-browser#44888: Use --button-opacity-disabled for disabled styling.
• Bug tor-browser#44955: Use context-fill for about-wordmark.svg
• Bug tor-browser#44956: Switch colours in letterboxing setting icons to match the tab-alignment icons
• Bug tor-browser#45016: Several errors about EngineProcess.sys.mjs in 152
• Bug tor-browser#45017: Wrong letterboxing background in 152
• Bug tor-browser#45037: Potential runtime errors in the search service when changing JS status
• Bug tor-browser#45043: Re-add missing changes to settings after 151/152 rebase
• Bug tor-browser#45083: Error in about:preferences due to ipprotection missing

macOS

• Bug tor-browser#44728: Bundled fonts are broken on macOS when the GPU process is enabled

Linux

• Bug @ libfontconfig.so.1#45048: Backport Bugzilla 2041887: Crash in after users upgraded to fontconfig 2.18.0 [tor-browser]

Android

• Updated GeckoView to 152.0a1
• Bug tor-browser#43856: Fix onBackPressed() deprecation
• Bug tor-browser#44091: Add frequent regions to tor connection assist for android
• Bug tor-browser#44175: Remove all default browser functionality (Android)
• Bug tor-browser#44769: TBA crash screen has firefox asset as well as a "Send crash report" button
• Bug tor-browser#45052: Initialise Tor modules on android in the same order as desktop

Build System

All Platforms

• Bug tor-browser-build#41802: Remove the tor daemon requirement for signing
• Bug tor-browser-build#41809: Update toolchains for Firefox 152
• Bug tor-browser-build#41813: Disable build artifacts in make generate_gradle_dependencies_list-geckoview
• Bug tor-browser-build#41821: Update gpg subkeys for boklm
• Bug tor-browser-build#41823: Add versions information to the toolchain list update
• Bug tor-browser-build#41827: Update morgan's keychain with renewed key

Windows + Linux + Android

• Updated Go to 1.26.4

Windows

• Bug tor-browser-build#41810: Define GetAddrInfoExCancel on mingw

Android

• Bug tor-browser#45086: Compress omni.ja with xz on Android
• Bug tor-browser-build#41830: Update the browser project to change omni.ja.xz

Original source

Tor Browser 15.0.17 is now available from the Tor Browser download page and also from our distribution directory.

This version includes important security updates to Tor.

Send us your feedback

If you find a bug or have a suggestion for how we could improve this release, please let us know.

Full changelog

The full changelog since Tor Browser 15.0.16 is:

• All Platforms
  • Updated Tor to 0.4.9.11
  • Updated NoScript to 13.6.25.1984
• Build System
  • All Platforms
    • Bug tor-browser-build#41821: Update gpg subkeys for boklm
    • Bug tor-browser-build#41827: Update morgan's keychain with renewed key

Original source

Tor Browser 15.0.16 is now available from the Tor Browser download page and also from our distribution directory.

This version includes important security updates to Firefox.

Send us your feedback

If you find a bug or have a suggestion for how we could improve this release, please let us know.

Full changelog

The full changelog since Tor Browser 15.0.16 is:

• All Platforms
  • Updated NoScript to 13.6.24.1984
  • Updated OpenSSL to 3.5.7
  • Bug tor-browser#45044: NS 13.6.19.902 DocStartInjection regressed
  • Bug tor-browser#45046: Rebase Tor Browser stable onto 140.12.0esr
  • Bug tor-browser#45054: Backport Security Fixes from Firefox 152
• Windows + macOS + Linux
  • Updated Firefox to 140.12.0esr
• Android
  • Updated GeckoView to 140.12.0esr
• Build System
  • All Platforms
    • Bug tor-browser-build#41802: Remove the tor daemon requirement for signing
  • Windows + Linux + Android
    • Updated Go to 1.25.11

Original source

Tor Browser 16.0a7 is now available from the Tor Browser download page and also from our distribution directory.

This version includes important security updates to Firefox.

⚠️ Reminder: The Tor Browser Alpha release-channel is for testing only. As such, Tor Browser Alpha is not intended for general use because it is more likely to include bugs affecting usability, security, and privacy.

Moreover, Tor Browser Alphas are now based on Firefox's betas. Please read more about this important change in the Future of Tor Browser Alpha blog post.

If you are an at-risk user, require strong anonymity, or just want a reliably-working browser, please stick with the stable release channel.

Send us your feedback

If you find a bug or have a suggestion for how we could improve this release, please let us know.

Full changelog

The full changelog since Tor Browser 16.0a6 is:

• All Platforms

  • Updated NoScript to 13.6.19.90401984
  • Updated Tor to 0.4.9.9
  • Bug tor-browser#42436: Allow for multiple configured (front, reflector) domain fronting pairs in Moat module
  • Bug tor-browser#44869: Rebase alpha onto 151
  • Bug tor-browser#44952: TOR_PROVIDER=none throws an error at launch
  • Bug tor-browser#44989: Backport Bug 2040704: Fix date format leak in Firefox 151
  • Bug tor-browser#44990: CI failing due to dubious ownership of cached repo
  • Bug tor-browser#44999: Privacy settings are broken in 151
  • Bug tor-browser-build#41686: Copy more build artifacts to the artifacts directory

• Windows + macOS + Linux

  • Updated Firefox to 151.0a1
  • Bug tor-browser#44903: Use the support-page instead of tor-manual-page in moz-support-link
  • Bug tor-browser#44904: Use settings config for onion site settings
  • Bug tor-browser#44991: Improve the no-authentication handling on the control port
  • Bug tor-browser#44997: Captcha doesn't work in TB desktop
  • Bug tor-browser#45005: Rename arrowpanel CSS variable

• Windows

  • Bug tor-browser#44745: Change how we hide SSO setting for windows

• Android

  • Updated GeckoView to 151.0a1
  • Bug tor-browser#43543: Make the dev icon distinct from the nightly one
  • Bug tor-browser#44211: Disable "Shake it up. Skip the scroll."
  • Bug tor-browser#44323: Audit Android Settings changes from 128 to 140
  • Bug tor-browser#44917: Disable Ads client for all channels
  • Bug tor-browser#45031: Disable AI features for Android

• Build System

  • All Platforms

    • Bug tor-browser-build#41779: Update toolchains for Firefox 151
    • Bug tor-browser-build#41781: Fix clean section in rbm.local.conf.example
    • Bug tor-browser-build#41792: Switch from ftp.gnu.org to ftpmirror.gnu.org
    • Bug tor-browser-build#41798: Update the URL to versions.ini in relprep.py
    • Bug tor-browser-build#41806: make list_toolchain_updates should check var/firefox_platform_version
    • Bug tor-browser-build#41807: Incorrectly generated Bugzilla query link in generate-bugzilla-triage-csv.py

  • Windows + Linux + Android

    • Updated Go to 1.26.3

  • macOS

    • Bug tor-browser-build#41793: Stop copying permissions from .mar in dmg2mar

  • Android

    • Bug tor-browser-build#41801: Hardlink artifacts in fix_gradle_deps.py

Original source

Tor Browser 15.0.15 is now available from the Tor Browser download page and also from our distribution directory.

This release contains important security updates to the tor daemon and fixes some censorship circumvention problems.

Send us your feedback

If you find a bug or have a suggestion for how we could improve this release, please let us know.

Full changelog

The full changelog since Tor Browser 15.0.14 is:

• All Platforms
  • Updated NoScript to 13.6.20.1984
  • Updated Tor to 0.4.9.9
  • Bug tor-browser#42436: Allow for multiple configured (front, reflector) domain fronting pairs in Moat module
• Windows + macOS + Linux
  • Bug tor-browser#44997: Captcha doesn't work in TB desktop
• Linux
  • Bug tor-browser#44886: Backport tor-browser#44361: Notify Linux i686 users that they won't receive updates anymore

Original source

Tor Browser 15.0.14 is now available from the Tor Browser download page and also from our distribution directory.

This version includes important security updates to Firefox.

Send us your feedback

If you find a bug or have a suggestion for how we could improve this release, please let us know.

Full changelog

The full changelog since Tor Browser 15.0.13 is:

• All Platforms
  • Bug tor-browser#44958: Backport Security Fixes from Firefox 151
• Windows + macOS + Linux
  • Updated Firefox to 140.11.0esr
• Android
  • Updated GeckoView to 140.11.0esr
• Build System
  • All Platforms
    • Bug tor-browser-build#41781: Fix clean section in rbm.local.conf.example
    • Bug tor-browser-build#41798: Update the URL to versions.ini in relprep.py
  • Windows + Linux + Android
    • Updated Go to 1.25.10

Original source

Tor Browser 16.0a6 is now available from the Tor Browser download page and also from our distribution directory.

This version includes important security updates to Firefox.

⚠️ Reminder: The Tor Browser Alpha release-channel is for testing only. As such, Tor Browser Alpha is not intended for general use because it is more likely to include bugs affecting usability, security, and privacy.

Moreover, Tor Browser Alphas are now based on Firefox's betas. Please read more about this important change in the Future of Tor Browser Alpha blog post.

If you are an at-risk user, require strong anonymity, or just want a reliably-working browser, please stick with the stable release channel.

Send us your feedback

If you find a bug or have a suggestion for how we could improve this release, please let us know.

Full changelog

The full changelog since Tor Browser 16.0a5 is:

All Platforms

• Updated tor to 0.4.9.7
• Updated NoScript to 13.6.18.90101984
• Updated OpenSSL to 3.5.6
• Bug tor-browser#43857 : Review in-source TODOs
• Bug tor-browser#44402 : Re-enable ESLint rule mozilla/no-browser-refs-in-toolkit as an error
• Bug tor-browser#44749 : Check search engines parameter replacements
• Bug tor-browser#44792 : Rebase alpha onto 150.0a1
• Bug tor-browser#44796 : Adjust TorProviderBuilder to report the provider state to consumers
• Bug tor-browser#44828 : Remove browser module references from toolkit/modules/ActorManagerParent.sys.mjs
• Bug tor-browser#44841 : TorDomainIsolator proxy filter returns null on exception instead of preserving SOCKS proxy
• Bug tor-browser#44865 : Block chrome:///locale/ to content
• Bug tor-browser#44868 : Backport 138c33ea964b2e0a4875aadc39d8a948e0c2aace to 150 to fix Windows builds
• Bug tor-browser#44870 : Remove legacy branch from gitlab templates
• Bug tor-browser#44895 : Undo the patch for #44772
• Bug tor-browser-build#41775 : Update list of Snowflake STUN servers in default bridge line, 2026 edition
• Bug tor-browser-build#41778 : Remove base-browser from protected-branches.py
• Bug tor-browser-build#41780 : Create sha256sums-unsigned-build.txt in artifacts/$platform directories

Windows + macOS + Linux

• Updated Firefox to 150.0a1
• Bug tor-browser#43824 : Switch resource:// modules to use moz-src:
• Bug tor-browser#44288 : New identity fails to block loading a custom home page
• Bug tor-browser#44458 : Fix the "Connect" and ".onion available" button height
• Bug tor-browser#44560 : Customize the flags for alternate 'Application Data' directories
• Bug tor-browser#44630 : Use settings config to hide settings, rather than data-hidden-from-search or commenting out
• Bug tor-browser#44648 : Unexpected changes to SearchService.sys.mjs
• Bug tor-browser#44685 : Use border radius for letterboxing
• Bug tor-browser#44798 : Don't load about:torconnect into iframes
• Bug tor-browser#44829 : Hide the settings privacy card
• Bug tor-browser#44832 : Hide the Firefox mascot in about:neterror
• Bug tor-browser#44846 : about:torconnect redirect doesn't work with the new neterror page
• Bug tor-browser#44847 : Drop letterboxing sidebar rounded corner logic
• Bug tor-browser#44902 : Error in privacy preference initialisation due to missing dataCollectionViewProfilesMultiProfileBackupWarning
• Bug tor-browser-build#31860 : Start using LTO for firefox project

Windows

• Bug tor-browser#44862 : Fontvis is missing Segoe MDL2 Assets
• Bug tor-browser#44868 : Backport 138c33ea964b2e0a4875aadc39d8a948e0c2aace to 150 to fix Windows builds

macOS

• Bug tor-browser#44850 : Wrong path for bootstrapped tor daemon on macOS
• Bug tor-browser-build#41476 : Since 13.5-legacy is not longer supported, remove tools/signing/wrappers/sign-rcodesign

Linux

• Bug tor-browser#44361 : Notify Linux i686 users that they won't receive updates anymore
• Bug tor-browser#44521 : Disable widget.wayland.fractional-scale.enabled

Android

• Updated GeckoView to 150.0a1
• Bug tor-browser#44615 : Remove ability to "Rate/Review in Google Play" in app
• Bug tor-browser#44827 : Always enable noscript for android
• Bug tor-browser#44842 : Replace instances of SwitchPreference with SwitchPreferenceCompat
• Bug tor-browser#44848 : Do not overwrite Android toolchains on default mozconfigs
• Bug tor-browser#44880 : Fix edgeToEdge display issue presented in 150 android rebase
• Bug tor-browser#44925 : Fix bootstrap screen color styling for light mode presented in one of the rebases between 140 and 150
• Bug tor-browser#44935 : Remove incorrectly shown "open in app" notification dot on settings button

Build System

All Platforms

• Bug tor-browser-build#41591 : Remove support for old mar filenames when 13.5 legacy branch is EOL
• Bug tor-browser-build#41764 : Update toolchains for Firefox 150
• Bug tor-browser-build#41767 : Add jwilde to allowed signer for browser projects
• Bug tor-browser-build#41778 : Remove base-browser from protected-branches.py
• Bug tor-browser-build#41780 : Create sha256sums-unsigned-build.txt in artifacts/$platform directories
• Bug tor-browser-build#41786 : Add comment to rbm.local.conf.example warning about potential recursive loops in tmp_dir definition
• Bug rbm#40106 : Improve error message in case of recursive definition

Windows + macOS + Linux

• Bug tor-browser-build#41759 : Remove references to legacy release in tor-browser-build

Windows + Linux + Android

• Bug tor-browser-build#41770 : Update Go to 1.26.x
• Updated Go to 1.26.2

Windows

• Bug tor-browser#44853 : Update target in mozconfig-windows-x86_64 and mozconfig-windows-i686

macOS

• Bug tor-browser-build#41773 : Change the position of -mindepth when creating the dmg

Linux

• Bug tor-browser#44555 : Remove mozconfig-linux-i686

Android

• Bug tor-browser#44848 : Do not overwrite Android toolchains on default mozconfigs

Original source

Tor Browser 15.0.12 is now available from the Tor Browser download page and also from our distribution directory.
This version includes important security updates to Firefox.

Send us your feedback

If you find a bug or have a suggestion for how we could improve this release, please let us know.

Full changelog

The full changelog since Tor Browser 15.0.11 is:

• All Platforms
  • Updated tor to 0.4.9.7
  • Bug tor-browser#44940: Rebase Tor Browser stable onto 140.10.2esr
• Windows + macOS + Linux
  • Updated Firefox to 140.10.2esr
  • Bug tor-browser#44746: Funding the Commons Implementation (Desktop)
• Android
  • Updated GeckoView to 140.10.2esr
  • Bug tor-browser#44747: Funding the Commons Implementation (Android)
• Build System
  • All Platforms
    • Bug tor-browser-build#41781: Fix clean section in rbm.local.conf.example

Original source